CVE-2026-47601: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

CVE-2026-47601 is a privilege escalation vulnerability in the NVIDIA GPU Display Driver for Windows and Linux, specifically in the open-source kernel module's DMA-BUF import path. An unprivileged local user can trigger improper preservation of memory access permissions when importing a read-only buffer from another device's DMA-BUF exporter, potentially leading to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vulnerability was disclosed on September 30, 2026, and affects NVIDIA GeForce, Tesla, RTX, Quadro, and NVS product lines across multiple driver branches. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat CVE).

The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-281 (Improper Preservation of Permissions), rooted in the NVIDIA open-source kernel module's handling of DMA-BUF (Direct Memory Access Buffer) imports. When a read-only buffer is imported from an external DMA-BUF exporter, the driver fails to correctly enforce the original memory access permissions, allowing a low-privileged local user to write beyond intended memory boundaries or gain write access to read-only memory regions. Exploitation requires local access with low privileges and no user interaction, making it straightforward for any authenticated local user on an affected system. No public proof-of-concept code has been identified at this time (Github Advisory, NVIDIA Product Security).

Successful exploitation allows an unprivileged local user to achieve arbitrary code execution, escalate privileges to higher system levels, cause denial of service, disclose sensitive information from memory, or tamper with data on the affected system. The vulnerability affects confidentiality, integrity, and availability at a high level, with potential for full system compromise on machines running vulnerable NVIDIA GPU drivers. Affected GPU architectures include Maxwell, Volta, and Pascal (specifically noted for GeForce), and the scope spans both Windows and Linux platforms across GeForce, Tesla, RTX, Quadro, and NVS product lines (Github Advisory, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.176% (0.00176), placing it in a low probability tier for near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires local access with low privileges, which limits the attack surface compared to remotely exploitable vulnerabilities.

NVIDIA has released patched driver versions across all affected product lines. Users should update to the following minimum versions or later:

• GeForce: 616.56, 580.178.04, 615.71.09, 610.60, 595.91.07, 610.57.04, 582.78 (Maxwell, Volta, Pascal architectures only)
• Tesla: 580.178.04, 615.71.09, 595.91.07, 596.86, 610.57.04, 610.88, 616.92
• RTX / Quadro / NVS: 582.78, 580.178.04, 615.71.09, 616.92, 595.91.07, 596.86, 610.57.04, 610.88

Organizations should prioritize updating drivers on multi-user systems (e.g., Linux servers, shared workstations) where untrusted local users may have access. No configuration-based workaround has been published; driver update is the recommended remediation (NVIDIA Product Security, HP Advisory).

The vulnerability was part of NVIDIA's September 2026 GPU Display Driver security bulletin (bulletin 5861), which addressed a large number of CVEs simultaneously, drawing attention from the Linux gaming community (Gaming on Linux). Red Hat tracked the issue and HP issued a corresponding advisory (HPSBHF04158) for affected HP products (HP Advisory). Tenable released detection plugins for the vulnerability shortly after disclosure. No significant independent researcher commentary or social media controversy has been identified beyond routine vulnerability tracking.