CVE-2026-47504

A flaw was found in nvidia-driver. The driver's NGX updater relies on an outdated embedded cryptographic library that is susceptible to type confusion, an issue where data of one type is incorrectly treated as another. A local attacker with low privileges can exploit this vulnerability to achieve arbitrary code execution, trigger a denial of service (DoS), or access and modify sensitive system data.

This vulnerability is rated as an Important severity because local authenticated attackers with low privileges could achieve arbitrary code execution or compromise system integrity and confidentiality, though exploitation requires prior local access rather than being remotely triggerable. Red Hat Enterprise Linux driver packages do not include the vulnerable NGX updater component, meaning default Red Hat environments are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.