CVE Database›Document archive›CVE-2026-47600

CVE-2026-47600

nvidia-driver: nvidia-driver: Arbitrary code execution via improperly initialized resource

Loading…

Severity

Important

Red Hat Product Security

7.8

CVSS 3.1

Review impact separately from score.

Published · October 1, 2026

Updated · October 17, 2026

Description

A flaw was found in the NVIDIA GPU Display Driver. The driver's kernel mode layer improperly handles resources during error processing by operating on uninitialized data. A local user with low privileges could exploit this flaw to achieve arbitrary code execution, escalate privileges, access sensitive data, or cause a Denial of Service (DoS).

Statement

This vulnerability is rated as having an Important severity because local authenticated attackers can leverage the kernel-level defect to execute arbitrary code with elevated privileges, potentially compromising host integrity and availability. The attack surface is limited to environments where proprietary GPU drivers are explicitly deployed, and exploitation requires prior local system access rather than remote network reachability. In Red Hat Enterprise Linux, default installations do not include these drivers, and supported packages are unaffected because the vulnerable code path is not present.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-908 · Use of Uninitialized Resource