CVE-2026-47525

A flaw was found in nvidia-driver. The kernel mode layer improperly validates array indices during driver operations. A local attacker can exploit this vulnerability to achieve arbitrary code execution, escalate privileges, cause a Denial of Service (DoS), or tamper with system data.

This vulnerability is evaluated as having a Moderate impact because exploitation requires existing local access with elevated privileges to trigger the kernel-mode driver flaw. In typical Red Hat Enterprise Linux environments, the proprietary NVIDIA driver package is only deployed on systems equipped with dedicated NVIDIA hardware accelerators or GPUs. Although an attacker with administrative rights could potentially achieve arbitrary kernel execution or cause a system crash, the prerequisite of high privileges significantly restricts the practical attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the NVIDIA kernel driver from autoloading if GPU functionality is not required on the system:

1. Create a modprobe configuration file to blacklist the driver module:

echo "blacklist nvidia" > /etc/modprobe.d/blacklist-nvidia.conf
echo "install nvidia /bin/true" >> /etc/modprobe.d/blacklist-nvidia.conf

Warning: A system reboot is required for these configuration changes to take effect if the module is currently loaded into the running kernel.

Caveat: Blacklisting the driver disables hardware graphics acceleration, display output driven by the NVIDIA card, and compute workloads utilizing CUDA.