NVIDIA vGPU Manager on Linux: incorrect resource transfer across isolation boundaries

Impact

A resource is transferred between isolation spheres incorrectly, meaning an object ends up on the wrong side of the guest and host boundary the vGPU Manager maintains. This is an isolation defect rather than a memory-safety accident, so it can be triggered through supported operations instead of by corrupting anything. For an operator selling vGPU slices it means a resource belonging to one sphere becoming reachable from another, with code execution and data tampering listed as the consequences.

Who can reach it

Local to the vGPU host, reachable through the vGPU Manager's resource handling; in this bulletin's vGPU set the attacker is a user in a guest VM with a vGPU assigned.

What to do

Upgrade the Virtual GPU Manager on all Linux hypervisor hosts per NVIDIA bulletin 2026/5861; no fixed version is given in this record. Evacuate each host and reboot it to install the update.

References

Related entries

• NVIDIA Windows GPU driver: integer overflow in the DIAG escape handler causes an out-of-bounds writeCVE-2026-47575 · NVIDIA GPU Display Driver for Windows (DIAG escape handler)High
• NVIDIA Windows GPU driver: incorrect comparison in the kernel moduleCVE-2026-47577 · NVIDIA GPU Display Driver for Windows (kernel module)High
• NVIDIA Windows GPU driver: incorrect buffer size calculation in the kernel mode layerCVE-2026-47578 · NVIDIA GPU Display Driver for Windows (kernel mode layer, buffer size calculation)High
• NVIDIA Windows GPU driver: use-after-free with a scope-changing impact beyond the vulnerable componentCVE-2026-47579 · NVIDIA GPU Display Driver for Windows (kernel mode driver)High
• NVIDIA Windows GPU driver: type confusion in the kernel moduleCVE-2026-47583 · NVIDIA GPU Display Driver for Windows (kernel module)High
• NVIDIA Windows GPU driver: integer underflow in the kernel moduleCVE-2026-47585 · NVIDIA GPU Display Driver for Windows (kernel module, size arithmetic)High