NVIDIA vGPU Manager: crafted data in the GSP tracing shared buffer causes improper access
Impact
A guest VM user writes crafted data into a buffer shared with the GPU System Processor tracing component and causes improper access on the host side. GSP runs firmware on the GPU itself, below the hypervisor, so a flaw reached through it sits underneath the usual host defences. The shared buffer is a standing guest-to-host channel, which means this is reachable during normal operation rather than only in some unusual configuration.
Who can reach it
From inside a guest VM with a vGPU assigned, as a normal user of that VM.
What to do
Update the Virtual GPU Manager on every affected hypervisor host as directed by NVIDIA bulletin 2026/5861; the record gives no fixed version. This requires evacuating the host's VMs and rebooting it. If GSP tracing can be disabled in your deployment, check the bulletin for whether NVIDIA offers that as an interim mitigation rather than assuming it.
References
Related entries
- NVIDIA vGPU Manager: crafted guest RPC message causes an out-of-bounds write in the GSP pluginCVE-2026-47498 · NVIDIA vGPU Manager (GPU System Processor plugin, guest RPC handling)High
- NVIDIA vGPU Manager: guest-triggered out-of-bounds read in the host kernel mode layerCVE-2026-47499 · NVIDIA vGPU Virtual GPU Manager (kernel mode layer)High
- NVIDIA GPU driver: use-after-free reachable by an unprivileged user through ordinary driver callsCVE-2026-47500 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, object lifetime and refcounting)High
- NVIDIA Linux GPU driver: mismatched buffers during event buffer setup cause a kernel out-of-bounds writeCVE-2026-47501 · NVIDIA GPU Display Driver for Linux (kernel mode layer, event buffer setup)High
- NVIDIA vGPU Manager: guest-triggered integer overflow leads to memory corruptionCVE-2026-47502 · NVIDIA vGPU Virtual GPU Manager (kernel mode layer, size arithmetic)High
- NVIDIA vGPU plugin: guest RPC with an invalid performance state list size causes an out-of-bounds writeCVE-2026-47503 · NVIDIA Virtual GPU Manager (vGPU plugin, performance state list RPC)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.