CVE-2026-47600
nvidia-driver: nvidia-driver: Arbitrary code execution via improperly initialized resource
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 1, 2026
Updated · October 17, 2026
Description
A flaw was found in the NVIDIA GPU Display Driver. The driver's kernel mode layer improperly handles resources during error processing by operating on uninitialized data. A local user with low privileges could exploit this flaw to achieve arbitrary code execution, escalate privileges, access sensitive data, or cause a Denial of Service (DoS).
Statement
This vulnerability is rated as having an Important severity because local authenticated attackers can leverage the kernel-level defect to execute arbitrary code with elevated privileges, potentially compromising host integrity and availability. The attack surface is limited to environments where proprietary GPU drivers are explicitly deployed, and exploitation requires prior local system access rather than remote network reachability. In Red Hat Enterprise Linux, default installations do not include these drivers, and supported packages are unaffected because the vulnerable code path is not present.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-908 · Use of Uninitialized Resource