CVE Database›Document archive›CVE-2026-47597

CVE-2026-47597

nvidia-driver: nvidia-driver: Arbitrary code execution via use-after-free in Resource Server

Loading…

Severity

Important

Red Hat Product Security

7.8

CVSS 3.1

Review impact separately from score.

Published · October 1, 2026

Updated · November 4, 2026

Description

A flaw was found in the NVIDIA GPU Display Driver. An unprivileged local user can exploit a missing self-reference check during map cleanup in the open-source kernel module Resource Server, causing a use-after-free condition where released memory is improperly accessed. Successful exploitation could allow an attacker to execute arbitrary code, escalate privileges, or cause a denial of service (DoS).

Statement

This vulnerability is rated as Important severity because an authenticated local attacker with low privileges can trigger kernel-space memory corruption, potentially escalating to root privileges or causing a complete host denial of service. The risk applies specifically to Red Hat Enterprise Linux systems configured with NVIDIA GPU hardware utilizing the affected display driver kernel modules. Environments that do not deploy these specialized GPU drivers or lack the underlying hardware are not exposed to this flaw.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 · Expired Pointer Dereference