NVIDIA GPU driver: improper input validation in the kernel mode layer

CVSS 6.7CVE-2026-47522NVIDIA / GPU stack+2 more CVEscurated

Impact

Improper input validation in the kernel mode layer of the GPU display driver, which NVIDIA split across CVE-2026-47522, CVE-2026-47542 and CVE-2026-47543 in bulletin 2026/5861 - same component, same 6.7 score, same prerequisites, same fix. A privileged local user can feed the driver values it does not check, with outcomes up to kernel code execution and privilege escalation. NVIDIA does not name the affected entry points, so the honest reading is: on a node where an attacker already has high privileges, the GPU driver does not hold the line. One driver update closes all three.

Who can reach it

Local attacker with high privileges on the host, Windows or Linux.

What to do

Update the GPU display driver to the fixed branch in NVIDIA bulletin 2026/5861. Drain the node and reboot; a single roll covers all three ids.

Also covers 2 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2026-47542CVE-2026-47543

References

https://nvd.nist.gov/vuln/detail/CVE-2026-47522 https://github.com/NVIDIA/product-security/tree/main/2026/5861 https://www.cve.org/CVERecord?id=CVE-2026-47522

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.