NVIDIA vGPU: a guest can reach privileged host GPU resources it is not authorized for
Impact
A guest VM reaches host GPU resources that should be off limits to it, which is a direct break of the boundary vGPU exists to enforce. For a provider selling vGPU slices, that boundary is the product: a tenant VM touching host-side resources can affect or observe the GPU state of other VMs on the same physical board. The host has to be patched for this, not just the guest, so the maintenance falls on the hypervisor fleet.
Who can reach it
From inside a guest VM with a vGPU assigned. Authenticated as a normal user of that VM; no host credentials are needed.
What to do
Update the Virtual GPU Manager on every hypervisor host to the version NVIDIA lists in bulletin 2026/5861; the record gives no version number. Updating the vGPU Manager means migrating or shutting down every VM on the host and rebooting it, so plan this as a rolling host-by-host drain across the vGPU fleet.
References
Related entries
- NVIDIA Linux GPU driver: user-supplied data reaches a format stringCVE-2026-47494 · NVIDIA GPU Display Driver for Linux (format string handling)High
- NVIDIA vGPU Manager: guest-triggered out-of-bounds write in the host kernel mode layerCVE-2026-47495 · NVIDIA vGPU Virtual GPU Manager (kernel mode layer)High
- NVIDIA vGPU Manager: crafted data in the GSP tracing shared buffer causes improper accessCVE-2026-47497 · NVIDIA Virtual GPU Manager (GPU System Processor tracing, guest-host shared buffer)High
- NVIDIA vGPU Manager: crafted guest RPC message causes an out-of-bounds write in the GSP pluginCVE-2026-47498 · NVIDIA vGPU Manager (GPU System Processor plugin, guest RPC handling)High
- NVIDIA vGPU Manager: guest-triggered out-of-bounds read in the host kernel mode layerCVE-2026-47499 · NVIDIA vGPU Virtual GPU Manager (kernel mode layer)High
- NVIDIA GPU driver: use-after-free reachable by an unprivileged user through ordinary driver callsCVE-2026-47500 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, object lifetime and refcounting)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.