NVIDIA GPU driver: integer overflow in size arithmetic leads to an out-of-bounds write
Impact
A caller-controlled size calculation overflows, so the driver allocates less than it later writes and overruns the buffer; in one id the overrun lands in GPU memory. NVIDIA assigned two ids for this pattern in bulletin 2026/5861 (CVE-2026-47510 and CVE-2026-47556) with the same score and the same driver fix. Overflowed length checks are attractive to exploit because the attacker picks the arithmetic, and on a GPU node the driver sits at host privilege above every tenant workload.
Who can reach it
Local, unprivileged. Any tenant with a GPU pod or a local user holding the NVIDIA device nodes.
What to do
Apply the driver update from NVIDIA bulletin 2026/5861; the record does not state fixed versions. One update covers both ids. Drain each GPU node and reboot; update the guest driver inside affected VMs as well.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- NVIDIA GPU driver: integer underflow in the kernel mode layerCVE-2026-47540 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, size arithmetic)High
- NVIDIA GPU driver: unprivileged out-of-bounds writes in the kernel mode layerCVE-2026-47511 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer)High
- NVIDIA GPU driver: out-of-bounds reads leak kernel heap and stack contents to an unprivileged userCVE-2026-47512 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, kernel memory disclosure)High
- NVIDIA vGPU Manager on Linux: out-of-bounds reads in the host kernel mode layerCVE-2026-47519 · NVIDIA vGPU Virtual GPU Manager for Linux (kernel mode layer)High
- NVIDIA GPU firmware: access of an uninitialized pointer reachable from a local attackerCVE-2026-47528 · NVIDIA GPU firmware as shipped with the GPU Display Driver (uninitialized pointer access)High
- NVIDIA vGPU Manager on Linux: out-of-bounds read in GPU firmwareCVE-2026-47535 · NVIDIA vGPU Virtual GPU Manager for Linux (GPU firmware)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.