CVE-2026-47586

A flaw was found in nvidia-driver. A vulnerability in the kernel module allows an attacker with physical access to trigger a use-after-free condition, which occurs when the driver accesses memory that has already been released. Successful exploitation could allow the attacker to achieve arbitrary code execution, escalate privileges, cause a Denial of Service (DoS), or tamper with system data.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires physical access to the target host alongside high attack complexity. Although a kernel module memory corruption issue could potentially lead to privilege escalation or system instability, the prerequisite of physical machine access significantly restricts the attack surface in standard enterprise environments. Systems without physical host exposure or configurations that do not load the proprietary NVIDIA driver are not susceptible to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue on systems where NVIDIA GPU hardware is not actively required, prevent the kernel module from autoloading:

1. Create a modprobe configuration file to prevent loading the module:

echo "install nvidia /bin/true" > /etc/modprobe.d/disable-nvidia.conf

2. If the module is currently loaded, reboot the system to ensure it is completely unloaded from the kernel.

Caveat: Disabling this module will disable all NVIDIA GPU acceleration, display output, and CUDA compute capabilities. A system restart is required for this change to take effect if the driver is currently loaded into memory.