Local use-after-free race in NVIDIA GPU Display Driver for Linux may enable kernel compromise

NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged local user could cause a use-after-free through a race between asynchronous event delivery and file close. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

The record sets default status to unaffected for the listed product entries, while the following ranges are marked affected:

• GeForce: all driver versions prior to 615.71.09; prior to 610.57.04; prior to 595.91.07; and prior to 580.178.04, for the respective NVIDIA-listed branches.
• RTX, Quadro, NVS: all driver versions prior to 615.71.09; prior to 610.57.04; prior to 595.91.07; and prior to 580.178.04, for the respective NVIDIA-listed branches.
• Tesla: all driver versions prior to 615.71.09; prior to 610.57.04; prior to 595.91.07; and prior to 580.178.04, for the respective NVIDIA-listed branches.
• Guest driver: 595.71.05 with all versions prior to and including vGPU 20.1; and 580.159.03 with all versions prior to and including vGPU 19.5.
• Virtual GPU Manager: 595.71.03 with all versions prior to and including vGPU 20.1; and 580.159.01 with all versions prior to and including vGPU 19.5.

The status of branches or versions not listed should not be inferred from these boundaries alone.

The flaw is in the NVIDIA GPU Display Driver for Linux event delivery path within the open-source kernel module. An unprivileged local user can trigger a race between asynchronous event delivery and file close, causing the driver to use memory after it has been freed, which is classified as CWE-416. The high-level precondition is local access to a Linux system using an affected driver; the record does not identify a syscall, ioctl, function, file path, or payload. Because the flaw occurs in a kernel module, controlling the timing of object release and reuse could result in memory corruption, but the exact implementation path to each listed outcome is not established by the available evidence.

Exploitation requires local access and a low-privilege user account. The record describes high attack complexity, no required user interaction, and no remote attack path. The supplied record marks public exploit as false, but that does not establish that exploitation has never occurred. No confirmed exploit code, exploit steps, or intrusion indicators are provided.

A use-after-free in the open-source kernel module can corrupt kernel memory when event delivery runs concurrently with file close. If the race can be controlled, an attacker may cause a crash or denial of service; under favorable conditions, the flaw may lead to code execution or privilege escalation. The record also identifies possible information disclosure and data tampering. Scope is described as unchanged, but confidentiality, integrity, and availability of the system running the driver may still be affected. The likelihood of each specific outcome depends on implementation details that have not been disclosed.

• An unprivileged local user may be able to affect kernel security on a system running an affected driver.
• Possible consequences include execution with higher privileges, privilege escalation, GPU or system service disruption, information disclosure, and data modification.
• Linux hosts using the NVIDIA GPU Display Driver, as well as vGPU deployments with a Guest driver or Virtual GPU Manager, should be included in the review.
• The record does not confirm a specific compromise, campaign, victim, or data-loss event.

1. Inventory driver versions on Linux hosts and vGPU components, then update each affected branch to a release outside its corresponding affected range. The recorded boundaries for GeForce, RTX, Quadro, NVS, and Tesla are 615.71.09, 610.57.04, 595.91.07, and 580.178.04, depending on the product branch.
2. Handle vGPU Guest driver and Virtual GPU Manager separately. The record provides affected vGPU ranges but does not state an independent fixed release for each vGPU line, so verify the matching NVIDIA update before deployment.
3. Recheck versions after updating and verify the driver loaded by the kernel, not only the package version stored on disk.
4. No specific temporary mitigation is confirmed in the available evidence. If updating is not immediately possible, restrict unnecessary local access as a temporary exposure-reduction measure, not as a vendor-confirmed fix.

• Inventory Linux hosts running the NVIDIA GPU Display Driver, including the driver version and whether the open-source kernel module is in use.
• Compare each driver branch with the affected boundaries in affected_summary; checking one branch does not establish the status of parallel branches.
• In vGPU environments, check Guest driver and Virtual GPU Manager versions separately together with the corresponding vGPU release.
• Review NVIDIA kernel module crashes or abnormal stability events as a precaution. The available evidence does not identify a specific log event, IOC, or crash signature, and the absence of such evidence does not prove that a system is safe.