NVIDIA vGPU plugin: guest RPC with an invalid performance state list size causes an out-of-bounds write

Impact

The vGPU plugin accepts a performance state list size from a guest RPC message without validating it and writes out of bounds. The named parameter makes this the most concretely described guest-to-host write in the bulletin, and performance state queries are routine traffic from a guest driver. On a shared vGPU host, a guest that lands this write is operating in host context against the resources of every co-tenant VM.

Who can reach it

From inside a guest VM with a vGPU assigned, as an ordinary user of that VM. No host access required.

What to do

Update the Virtual GPU Manager on every hypervisor host per NVIDIA bulletin 2026/5861; the record does not state a fixed version. Evacuate each host's VMs and reboot to install, rolling across the fleet.

References

Related entries

• NVIDIA Linux driver NGX updater: outdated embedded crypto library is vulnerable to type confusionCVE-2026-47504 · NVIDIA Linux GPU Display Driver (NGX updater, embedded cryptographic library)High
• NVIDIA Windows GPU driver: use-after-free in the kernel mode layerCVE-2026-47505 · NVIDIA GPU Display Driver for Windows (kernel mode layer)High
• NVIDIA GPU driver: out-of-bounds array access in the kernel mode layerCVE-2026-47507 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, array indexing)High
• NVIDIA GPU driver: incorrect conversion between numeric types in the kernel mode layerCVE-2026-47508 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, numeric conversion)High
• NVIDIA GPU driver: integer overflow in size arithmetic leads to an out-of-bounds writeCVE-2026-47510 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, size arithmetic)High
• NVIDIA GPU driver: unprivileged out-of-bounds writes in the kernel mode layerCVE-2026-47511 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer)High