Two Nvidia Linux Driver Flaws Let GPU Container Users Take Host Root

What happened

Stealthium published technical details of both flaws on Nov 12. NvRoot sits in a driver memory-pin request: two permission fields in the request contradict each other, the driver honors one of them, and the GPU gains write access to a read-only file; the researchers rewrote the cached copy of /usr/bin/su and executed it to reach a root shell. ForgePtr sits in the event-buffer setup path: a caller-supplied handle is converted to a kernel pointer without checking whether the conversion succeeded, so a failed handle is treated as a valid pointer and, when freed, decrements a counter at that address — repeated decrements can write to any address.

Both flaws live in Nvidia's open-source kernel modules and have existed since the first open-source driver release, 515.43.04, in May 2022. The NvRoot fix shipped on Aug 3 in drivers 610.57.04, 595.91.07 and 580.178.04, the ForgePtr fix on Sep 9 in 615.71.09, and Nvidia's Sep 30 security bulletin covers both. Stealthium said the R590, R575, R570 and R565 branches, and older ones, still have no NvRoot fix; it also reproduced ForgePtr on 610.57.04, while Nvidia's bulletin lists 610.57.04 as the fix for both flaws — the two accounts do not agree.

The severity ratings also differ: Nvidia scores both flaws 7.8 High under CVSS 3.1, while Stealthium scores NvRoot 9.3 Critical under CVSS 4.0 and urges multi-tenant operators to treat it as Critical. Stealthium said more than 25 further High or Critical findings are going through responsible disclosure and will be published in turn; it published no proof-of-concept code and held back some details.

Key facts

1. NvRoot: CVE-2026-47591: the driver trusts the wrong permission field, letting an unprivileged user have the GPU rewrite a read-only file; root was reproduced on 610.43.02 and fixed in 610.57.04
2. ForgePtr: CVE-2026-47501: a missing error check in handle-to-pointer conversion allows writes to any kernel address, then switching off ASLR, kernel lockdown, module signing and Secure Boot runtime enforcement
3. Fixes: NvRoot fixed Aug 3 in 610.57.04 and other branches; ForgePtr fixed Sep 9 in 615.71.09; Nvidia's Sep 30 bulletin covers both
4. Severity: Nvidia rates both 7.8 High under CVSS 3.1; Stealthium rates NvRoot 9.3 Critical under CVSS 4.0
5. Gaps: The R590, R575, R570 and R565 branches and older ones have no NvRoot fix; the two sides disagree on whether 610.57.04 fixes ForgePtr
6. Attribution: Nvidia's bulletin credits NvRoot's discovery to another researcher, while Stealthium says its own team found and reported it; the accounts are unreconciled
7. Next: Stealthium says more than 25 further High or Critical findings are pending disclosure; there is no workaround short of updating the driver