CVE-2026-47598

A flaw was found in the NVIDIA GPU Display Driver for Linux. A race condition between asynchronous event delivery and file close operations in the open-source kernel module can lead to a use-after-free condition, where memory is accessed after it has already been released. A local unprivileged attacker could exploit this vulnerability to achieve arbitrary code execution, escalate privileges, or cause a denial of service (DoS).

This vulnerability is assessed as Moderate severity rather than Important because successful exploitation requires local authenticated access and depends on winning a tight timing window, despite the theoretical potential for privilege escalation. In Red Hat Enterprise Linux, this issue exclusively impacts hosts equipped with NVIDIA graphics hardware running the optional open-source kernel driver packages. Default installations that do not utilize NVIDIA GPUs or that rely on standard open-source display stacks are completely unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the NVIDIA kernel driver module from being loaded on systems where dedicated NVIDIA GPU capabilities are not required:

1. Create a configuration file to disable loading the module:

echo "install nvidia /bin/true" > /etc/modprobe.d/disable-nvidia.conf

Warning: A system reboot is required for this configuration to take effect if the module is already loaded in memory.

Caveats: Applying this configuration disables NVIDIA GPU hardware acceleration, graphical output, and compute workloads on the system.