Loading vulnerability…
NvRoot
NvRoot (CVE-2026-47591) is an incorrect-authorization vulnerability in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux. An unprivileged local user can bypass read-only memory protection and obtain write access to memory marked read-only. The vulnerability enables local privilege escalation, including elevation to root, and may also cause code execution, denial of service, information disclosure, and data tampering. Shared, multi-tenant GPU systems are a particularly relevant exposure scenario.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise system confidentiality, integrity, and availability by allowing an unprivileged local user to modify protected memory and potentially obtain root privileges. Additional possible consequences include code execution, sensitive-information disclosure, unauthorized data modification, and denial of service. The CVSS v3 base score is 7.8 (High), with high confidentiality, integrity, and availability impacts.
If you can’t patch tonight, do this now.
No sysctl or seccomp workaround is identified for NvRoot. No separate validated workaround is specified; applying the appropriate driver security update is the established corrective action.
Patch, then assume compromise.
Install the applicable NVIDIA GPU Display Driver security update. Identified fixed driver releases are 610.57.04, 595.91.07, and 580.178.04; select the release appropriate to the installed driver branch or a subsequent patched release. Distribution-specific fixes include updating x11-drivers/nvidia-drivers-open580 and related packages to version 20162.0.0 or later on the applicable Google COS release, and updating nvidia-graphics-drivers and related packages to version 590.48.01-0ubuntu1+e1 or later on affected Echo systems. Use the platform vendor's package guidance when applying distribution-maintained fixes.
No public exploits tracked yet. Mallory keeps watching.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.