CVE-2026-47590

A flaw was found in the NVIDIA GPU display driver. A local, unprivileged attacker can trigger a use-after-free memory issue (accessing memory after it has been released) by issuing a specific sequence of driver commands. Successful exploitation may allow the attacker to achieve arbitrary code execution, escalate privileges, cause a denial of service (DoS), or expose sensitive information.

This vulnerability is rated as Important because an authenticated local user can trigger a kernel-level use-after-free condition to compromise host confidentiality, integrity, and availability. While the blast radius can lead to full privilege escalation and arbitrary code execution within the kernel context, exploitation is limited to systems configured with proprietary NVIDIA hardware drivers and requires local access. Deployments that do not utilize discrete NVIDIA GPUs or that rely exclusively on open-source graphics drivers such as nouveau remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the NVIDIA display driver kernel module from loading on systems where dedicated GPU processing or display hardware is not required:

1. Create a configuration file in /etc/modprobe.d/ to blacklist the driver:

echo "blacklist nvidia" > /etc/modprobe.d/blacklist-nvidia.conf

echo "install nvidia /bin/true" >> /etc/modprobe.d/blacklist-nvidia.conf

Caveats: Disabling the driver will disable proprietary GPU acceleration, graphical display sessions, and GPU compute capabilities across affected systems.

Warning: If the driver module is actively loaded, a full system restart is required to completely unload the module and apply these configuration changes.