CVE-2026-47603: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

CVE-2026-47603 is an information disclosure vulnerability in the NVIDIA GPU Display Driver for Windows and Linux, where a local user may access another process's GPU channel state due to missing authorization checks in the kernel mode driver. It was disclosed on September 30, 2026, as part of NVIDIA's Security Bulletin 5861 (GPU Display Driver – September 2026). Affected products include NVIDIA GeForce, RTX/Quadro/NVS, Tesla, Virtual GPU Manager, and Guest driver across multiple driver branches on both Windows and Linux. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-862 (Missing Authorization) and CWE-283 (Unverified Ownership): the kernel mode driver fails to verify that a requesting process is authorized to access GPU channel state belonging to another process (Github Advisory). The attack vector is local, requiring low privileges and no user interaction, making it exploitable by any unprivileged local user on an affected system. For GeForce products, only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected in certain driver branches (Red Hat Bugzilla). No public proof-of-concept or detailed technical write-up has been published as of the time of disclosure.

Successful exploitation allows a low-privileged local user to read GPU channel state information belonging to other processes, resulting in a high confidentiality impact with no effect on integrity or availability. Sensitive data being processed on the GPU by other users or applications — such as in multi-tenant or shared GPU environments — could be exposed to an unauthorized local user. The risk is most significant in virtualized or multi-user environments (e.g., systems running NVIDIA vGPU) where multiple workloads share GPU resources (Github Advisory, Red Hat Bugzilla).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation as of the disclosure date (Red Hat Bugzilla). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.14%, indicating a low near-term probability of exploitation. The attack is not automatable and requires local access with low privileges, limiting its exposure compared to remotely exploitable vulnerabilities.

NVIDIA has released patched driver versions addressing this vulnerability. Users should update to the following minimum versions based on their product line:

• GeForce: 616.56 (Windows), 615.71.09 (Linux), 610.88, 610.57.04, 595.91.07, 582.78, or 580.178.04 depending on branch
• RTX, Quadro, NVS: 616.92 (Windows), 615.71.09 (Linux), 610.88, 610.57.04, 596.86, 595.91.07, 582.78, or 580.178.04 depending on branch
• Tesla: 616.92 (Windows), 615.71.09 (Linux), 610.88, 610.57.04, 596.86, 595.91.07, or 580.178.04 depending on branch
• vGPU Guest driver: 596.36 or 595.71.05 (vGPU 20.x), 582.53 or 580.159.03 (vGPU 19.x)
• Virtual GPU Manager: 596.38 or 595.71.03 (vGPU 20.x), 582.51 or 580.159.01 (vGPU 19.x)

Prioritize patching systems where multiple users or processes share GPU resources concurrently, such as virtualized or multi-tenant environments (NVIDIA Product Security, HP Advisory).

Gaming on Linux covered the September 2026 NVIDIA security bulletin, noting multiple GPU driver issues addressed in the release (Gaming on Linux). Red Hat tracked the vulnerability via its security response process and opened a Bugzilla entry, classifying it as medium severity (Red Hat Bugzilla). HP also issued an advisory (HPSBHF04158) for affected HP products incorporating NVIDIA GPU drivers (HP Advisory). No significant social media controversy or researcher commentary beyond standard disclosure coverage has been observed.