nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size

cve CVE-2026-47561 3 sources, 3 claims · Watch

Red Hat writes:
nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size the claim

What it is to other things

In words only, so not counted until a person confirms one:

affects	`nvidia/geforce` NVD says “NVIDIA · GeForce”
made_by	`nvidia` NVD says “NVIDIA”

What each source says

Property	Source	Said	Means here
Cvss cvss	GitHub advisories	7.8 receipt Source GitHub advisories Its words `7.8` Read by `field:cvss.score` Said since 2026-10-02 11:59 UTC Last answered 2026-10-04 12:14 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-47561", "cvss": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_severities": { "cvss_v3": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-787", "name": "Out-of-bounds Write" } ], "description": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", "epss": { "percentage": 0.00186, "percentile": 0.07352 }, "ghsa_id": "GHSA-r37f-4h3r-rmc8", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-r37f-4h3r-rmc8", "identifiers": [ { "type": "GHSA", "value": "GHSA-r37f-4h3r-rmc8" }, { "type": "CVE", "value": "CVE-2026-47561" } ], "nvd_published_at": "2026-09-30T16:17:24Z", "published_at": "2026-09-30T18:33:43Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-47561", "https://github.com/NVIDIA/product-security/tree/main/2026/5861", "https://www.cve.org/CVERecord?id=CVE-2026-47561", "https://github.com/advisories/GHSA-r37f-4h3r-rmc8" ], "repository_advisory_url": null, "severity": "high", "source_code_location": "", "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the...", "type": "unreviewed", "updated_at": "2026-09-30T18:33:49Z", "url": "https://api.github.com/advisories/GHSA-r37f-4h3r-rmc8", "vulnerabilities": [], "withdrawn_at": null }	—
Cvss cvss	NVD	7.8 receipt Source NVD Its words `7.8` Read by `field:cve.metrics.cvssMetricV31[].cvssData.baseScore` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 20)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.05(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 19)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.03(All versions prior to and including vGPU 19.5)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.03(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.01(All versions prior to and including vGPU 19.5)" } ] } ], "source": "psirt@nvidia.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering." } ], "id": "CVE-2026-47561", "lastModified": "2026-10-01T04:18:16.450", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@nvidia.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-47561", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2026-09-30T00:00:00+00:00", "version": "2.0.3" } } ] }, "published": "2026-09-30T16:17:24.693", "references": [ { "source": "psirt@nvidia.com", "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861" }, { "source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47561" }, { "source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47561" } ], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-787" } ], "source": "psirt@nvidia.com", "type": "Secondary" } ] } }	—
Cvss cvss	Red Hat	7.8 receipt Source Red Hat Its words `7.8` Read by `field:cvss3_score` Said since 2026-10-02 12:01 UTC Last answered 2026-10-04 12:16 UTC Original open at the source What the source handed over { "CVE": "CVE-2026-47561", "CWE": "CWE-787", "advisories": [], "affected_packages": [], "bugzilla": "2544016", "bugzilla_description": "nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size", "cvss3_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvss_score": null, "cvss_scoring_vector": null, "package_state": null, "public_date": "2026-09-30T15:50:27Z", "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-47561.json", "severity": "important" }	—
Cwe cwe	GitHub advisories	CWE-787 receipt Source GitHub advisories Its words `CWE-787` Read by `field:cwes[].cwe_id` Said since 2026-10-02 11:59 UTC Last answered 2026-10-04 12:14 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-47561", "cvss": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_severities": { "cvss_v3": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-787", "name": "Out-of-bounds Write" } ], "description": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", "epss": { "percentage": 0.00186, "percentile": 0.07352 }, "ghsa_id": "GHSA-r37f-4h3r-rmc8", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-r37f-4h3r-rmc8", "identifiers": [ { "type": "GHSA", "value": "GHSA-r37f-4h3r-rmc8" }, { "type": "CVE", "value": "CVE-2026-47561" } ], "nvd_published_at": "2026-09-30T16:17:24Z", "published_at": "2026-09-30T18:33:43Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-47561", "https://github.com/NVIDIA/product-security/tree/main/2026/5861", "https://www.cve.org/CVERecord?id=CVE-2026-47561", "https://github.com/advisories/GHSA-r37f-4h3r-rmc8" ], "repository_advisory_url": null, "severity": "high", "source_code_location": "", "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the...", "type": "unreviewed", "updated_at": "2026-09-30T18:33:49Z", "url": "https://api.github.com/advisories/GHSA-r37f-4h3r-rmc8", "vulnerabilities": [], "withdrawn_at": null }	—
Cwe cwe	Red Hat	CWE-787 receipt Source Red Hat Its words `CWE-787` Read by `field:CWE` Said since 2026-10-02 12:01 UTC Last answered 2026-10-04 12:16 UTC Original open at the source What the source handed over { "CVE": "CVE-2026-47561", "CWE": "CWE-787", "advisories": [], "affected_packages": [], "bugzilla": "2544016", "bugzilla_description": "nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size", "cvss3_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvss_score": null, "cvss_scoring_vector": null, "package_state": null, "public_date": "2026-09-30T15:50:27Z", "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-47561.json", "severity": "important" }	—
Product product	NVD	GeForce receipt Source NVD Its words `GeForce` Read by `field:cve.affected[].affectedData[].product` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 20)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.05(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 19)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.03(All versions prior to and including vGPU 19.5)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.03(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.01(All versions prior to and including vGPU 19.5)" } ] } ], "source": "psirt@nvidia.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering." } ], "id": "CVE-2026-47561", "lastModified": "2026-10-01T04:18:16.450", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@nvidia.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-47561", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2026-09-30T00:00:00+00:00", "version": "2.0.3" } } ] }, "published": "2026-09-30T16:17:24.693", "references": [ { "source": "psirt@nvidia.com", "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861" }, { "source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47561" }, { "source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47561" } ], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-787" } ], "source": "psirt@nvidia.com", "type": "Secondary" } ] } }	—
Severity severity	GitHub advisories	high From 7.0 to 8.9. receipt Source GitHub advisories Its words `high` Read by `field:severity` Said since 2026-10-02 11:59 UTC Last answered 2026-10-04 12:14 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-47561", "cvss": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_severities": { "cvss_v3": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [ { "cwe_id": "CWE-787", "name": "Out-of-bounds Write" } ], "description": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", "epss": { "percentage": 0.00186, "percentile": 0.07352 }, "ghsa_id": "GHSA-r37f-4h3r-rmc8", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-r37f-4h3r-rmc8", "identifiers": [ { "type": "GHSA", "value": "GHSA-r37f-4h3r-rmc8" }, { "type": "CVE", "value": "CVE-2026-47561" } ], "nvd_published_at": "2026-09-30T16:17:24Z", "published_at": "2026-09-30T18:33:43Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-47561", "https://github.com/NVIDIA/product-security/tree/main/2026/5861", "https://www.cve.org/CVERecord?id=CVE-2026-47561", "https://github.com/advisories/GHSA-r37f-4h3r-rmc8" ], "repository_advisory_url": null, "severity": "high", "source_code_location": "", "summary": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the...", "type": "unreviewed", "updated_at": "2026-09-30T18:33:49Z", "url": "https://api.github.com/advisories/GHSA-r37f-4h3r-rmc8", "vulnerabilities": [], "withdrawn_at": null }	—
Severity severity	Red Hat	important A flaw that can easily compromise confidentiality, integrity or availability. receipt Source Red Hat Its words `important` Read by `field:severity` Said since 2026-10-02 12:01 UTC Last answered 2026-10-04 12:16 UTC Original open at the source What the source handed over { "CVE": "CVE-2026-47561", "CWE": "CWE-787", "advisories": [], "affected_packages": [], "bugzilla": "2544016", "bugzilla_description": "nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size", "cvss3_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvss_score": null, "cvss_scoring_vector": null, "package_state": null, "public_date": "2026-09-30T15:50:27Z", "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-47561.json", "severity": "important" }	high
Status status	NVD	Awaiting Analysis receipt Source NVD Its words `Awaiting Analysis` Read by `field:cve.vulnStatus` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 20)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.05(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 19)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.03(All versions prior to and including vGPU 19.5)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.03(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.01(All versions prior to and including vGPU 19.5)" } ] } ], "source": "psirt@nvidia.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering." } ], "id": "CVE-2026-47561", "lastModified": "2026-10-01T04:18:16.450", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@nvidia.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-47561", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2026-09-30T00:00:00+00:00", "version": "2.0.3" } } ] }, "published": "2026-09-30T16:17:24.693", "references": [ { "source": "psirt@nvidia.com", "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861" }, { "source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47561" }, { "source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47561" } ], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-787" } ], "source": "psirt@nvidia.com", "type": "Secondary" } ] } }	—
Vendor vendor	NVD	NVIDIA receipt Source NVD Its words `NVIDIA` Read by `field:cve.affected[].affectedData[].vendor` Said since 2026-10-02 12:00 UTC Last answered 2026-10-04 12:15 UTC Original open at the source What the source handed over { "cve": { "affected": [ { "affectedData": [ { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "RTX, Quadro, NVS", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R615)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 615.71.09" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R610)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 610.57.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "Tesla", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R595)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 595.91.07" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(R580)" ], "product": "GeForce", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "All driver versions prior to 580.178.04" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 20)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.05(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Linux(vGPU 19)" ], "product": "Guest driver", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.03(All versions prior to and including vGPU 19.5)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "595.71.03(All versions prior to and including vGPU 20.1)" } ] }, { "defaultStatus": "unaffected", "platforms": [ "XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)" ], "product": "Virtual GPU Manager", "vendor": "NVIDIA", "versions": [ { "status": "affected", "version": "580.159.01(All versions prior to and including vGPU 19.5)" } ] } ], "source": "psirt@nvidia.com" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering." } ], "id": "CVE-2026-47561", "lastModified": "2026-10-01T04:18:16.450", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@nvidia.com", "type": "Secondary" } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "id": "CVE-2026-47561", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "timestamp": "2026-09-30T00:00:00+00:00", "version": "2.0.3" } } ] }, "published": "2026-09-30T16:17:24.693", "references": [ { "source": "psirt@nvidia.com", "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861" }, { "source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47561" }, { "source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47561" } ], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-787" } ], "source": "psirt@nvidia.com", "type": "Secondary" } ] } }	—

vulnerability

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: privilege escalation via unvalidated ioctl buffer size zetlyn/cve-redhat · 2026-09-30	cvss 7.8 cwe CWE-787 severity important	source
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. zetlyn/cve-nvd · 2026-09-30	cvss 7.8 product GeForce status Awaiting Analysis vendor NVIDIA	source
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the... zetlyn/cve-ghsa · 2026-09-30	cvss 7.8 cwe CWE-787 severity high	source