NVIDIA GPU driver: integer underflow in the kernel mode layer

Impact

A subtraction in the kernel mode layer underflows, turning a small value into a very large unsigned one that is then used as a length or bound. The usual consequence is a copy far past the end of a buffer. The trigger is available to an unprivileged local process, so on a GPU node any tenant with the device nodes can attempt it against host kernel memory.

Who can reach it

Local, unprivileged. Any tenant with a GPU pod or a local user with /dev/nvidia*.

What to do

Update to the driver branch in NVIDIA bulletin 2026/5861; the record names no fixed version. Drain and reboot each affected GPU node, including Virtual GPU Manager hosts.

References

Related entries

• NVIDIA GPU driver: integer overflow in size arithmetic leads to an out-of-bounds writeCVE-2026-47510 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, size arithmetic)High
• NVIDIA vGPU Manager on Linux: out-of-bounds write in the host kernel mode layerCVE-2026-47541 · NVIDIA vGPU Virtual GPU Manager for Linux (kernel mode layer)High
• NVIDIA Windows GPU driver: untrusted user pointer is dereferenced without validationCVE-2026-47550 · NVIDIA GPU Display Driver for Windows (kernel mode layer, pointer validation)High
• NVIDIA Linux GPU driver: unprivileged user bypasses an authorization check and changes privileged settingsCVE-2026-47552 · NVIDIA GPU Display Driver for Linux (kernel mode layer, privileged configuration)High
• NVIDIA Linux GPU driver: double-free of imported memory state in the kernel moduleCVE-2026-47558 · NVIDIA GPU Display Driver for Linux (kernel mode layer, imported memory state)High
• NVIDIA GPU driver: a user can access memory belonging to another user's processCVE-2026-47559 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, process memory isolation)High