CVE-2026-47549

A flaw was found in nvidia-driver. This vulnerability allows an unprivileged local user to cause a Denial of Service (DoS) by triggering an invalid memory access (NULL pointer dereference) in the kernel module. A successful exploit results in a system crash.

This vulnerability is rated as Moderate because exploitation requires local authenticated access and results strictly in a denial of service without compromising system confidentiality or integrity. In Red Hat Enterprise Linux environments, the driver is not enabled by default and is only loaded when compatible NVIDIA hardware is present and configured. An unprivileged local user could interact with the kernel module interface to trigger a kernel crash, disrupting host availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exposure on systems where NVIDIA GPU capabilities are not actively needed, prevent the kernel module from loading by creating a modprobe configuration file:

echo "install nvidia /bin/false" > /etc/modprobe.d/disable-nvidia.conf

If the driver is already loaded, unload it using:

modprobe -r nvidia

Additionally, if GPU functionality is required by trusted users, ensure file permissions on /dev/nvidia* device nodes restrict access to authorized groups only.

Caveats: Disabling this module prevents NVIDIA GPU hardware acceleration, compute workloads, and display outputs handled by the card.

Warning: Unloading the module while graphical sessions or compute workloads are active may abruptly terminate running processes. A system reboot is recommended to ensure the module is cleanly unloaded and the configuration takes effect.