CVE-2026-47604: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

CVE-2026-47604 is an information disclosure vulnerability in the NVIDIA GPU Display Driver for Windows and Linux, where a local user may access another process's GPU channel state due to missing authorization checks in the kernel mode driver. It was disclosed on September 30, 2026, as part of NVIDIA's GPU Display Driver Security Bulletin 5861. Affected products include NVIDIA GeForce, RTX/Quadro/NVS, Tesla, Guest driver (vGPU), and Virtual GPU Manager across a wide range of driver versions on both Windows and Linux. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Github Advisory, NVIDIA Product Security).

The root cause is classified under CWE-862 (Missing Authorization) and CWE-283 (Unverified Ownership), meaning the kernel mode driver fails to verify that a requesting process is authorized to access GPU channel state belonging to another process. An attacker with low-privileged local access can exploit this flaw by interacting with the vulnerable kernel driver interface to read GPU channel state data from other running processes without proper ownership verification. No user interaction is required, and the attack complexity is low, making it straightforward for any local user to attempt exploitation. No public proof-of-concept code has been identified at this time (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in unauthorized information disclosure, specifically allowing a low-privileged local user to read GPU channel state data belonging to other processes. This could expose sensitive data being processed on the GPU — such as cryptographic material, AI/ML model inputs, or rendered frame buffers — depending on what other processes are using the GPU concurrently. There is no impact on integrity or availability; the vulnerability is confined to confidentiality loss within the local system scope (Red Hat Advisory, Github Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.14% (1st percentile), indicating a low near-term probability of exploitation. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities (Github Advisory, Red Hat Advisory).

NVIDIA has released patched driver versions addressing this vulnerability. Users should update to the following minimum versions based on their product line:

• GeForce (Windows): 616.56 or later
• GeForce (Linux): 610.88, 610.57.04, 595.91.07, 580.178.04, or 615.71.09 (branch-dependent); for Maxwell/Pascal/Volta architectures, 582.78 or later
• RTX, Quadro, NVS (Windows): 616.92 or later
• RTX, Quadro, NVS (Linux): 610.88, 610.57.04, 595.91.07, 580.178.04, 596.86, or 615.71.09 (branch-dependent)
• Tesla (Windows/Linux): 616.92, 596.86, 610.88, 610.57.04, 595.91.07, 580.178.04, or 615.71.09 (branch-dependent)
• vGPU Guest Driver: Versions after vGPU 19.5 (582.53 / 580.159.03) and vGPU 20.1 (596.36 / 595.71.05)
• Virtual GPU Manager: Versions after vGPU 19.5 (582.51 / 580.159.01) and vGPU 20.1 (596.38 / 595.71.03)

Prioritize patching systems where multiple users share GPU access or where sensitive data is processed on GPUs. HP has also issued an advisory (HPSBHF04158) for affected HP systems using NVIDIA drivers (NVIDIA Product Security, HP Advisory, Red Hat Advisory).

Gaming on Linux covered the September 30, 2026 NVIDIA security bulletin, noting multiple GPU driver issues addressed in the release (Gaming on Linux). Red Hat tracked the vulnerability via Bugzilla as a medium-severity issue affecting the nvidia-driver and xorg-x11-drv-nvidia packages on Linux (Red Hat Bugzilla). No significant social media controversy or notable researcher commentary beyond standard disclosure coverage has been observed.