NVIDIA Rates NvRoot, ForgePtr Driver Flaws 7.8 High; Host Root Claimed

Security firm Stealthium on Nov. 12 published technical details of NvRoot (CVE-2026-47591) and ForgePtr (CVE-2026-47501), two flaws in NVIDIA's Linux GPU driver that it says let an unprivileged user inside a GPU container take root on the host. According to Stealthium, the NvRoot fix shipped on Aug. 3 in drivers 610.57.04, 595.91.07 (595.44.14 on the 595.44.x line) and 580.178.04, and the ForgePtr fix shipped on Sep. 9 in 615.71.09. NVIDIA listed both in its September 2026 GPU display driver security bulletin, first released on Sep. 30.

NVIDIA rates each flaw 7.8, or High, on CVSS 3.1, and its bulletin lists fixes for both, though Stealthium disputes one of them. Stealthium published no proof-of-concept code and held back some specifics. Hardware Busters, which covered the disclosure, noted the gap of about five weeks between the two fixes.

Why Multi-Tenant GPU Clouds Face the Most Risk

The stakes are highest for multi-tenant GPU clouds, the neoclouds that rent slices of a GPU server to customers they do not control. Stealthium says both attacks work from an unprivileged container with nothing more than access to the GPU device, and cross to the host. Root on a shared node exposes every other tenant on it, from model weights to live inference. Stealthium says there is no workaround short of updating the driver, and that hosts on an unpatched driver should not pass the /dev/nvidia* devices to tenants they do not fully trust.

How the two flaws work

NvRoot is a permission bug. When a program asks the driver to pin memory for the GPU, the request carries one permission for the CPU and one for the GPU. Stealthium says vulnerable drivers set the page permission from the CPU field alone, so the GPU could write to the cached copy of a file the caller could only read. Because the file on disk never changes, Stealthium says file-integrity checks see nothing.

ForgePtr is a missing error check. Stealthium says it lets an unprivileged caller write chosen bytes to a chosen kernel address, and adds that exploitation also needs a separate unprivileged leak of the kernel's address layout. With it, the researchers say they reached host root from a container, then switched off kernel lockdown and module signature enforcement, and loaded an unsigned kernel module on a Secure Boot machine. Stealthium says both flaws have been in NVIDIA's open-source kernel modules since the first release, 515.43.04, in May 2022.

What operators need to patch

NVIDIA's bulletin lists Linux updates on four branches: 615.71.09 on R615, 610.57.04 on R610, 595.91.07 on R595 and 580.178.04 on R580. It warns that earlier branches might also be affected and tells users of an unlisted branch to move to the latest branch release. Stealthium goes further and says that, at the time of writing, every release on R590, R575 and R570, and all of R565 and earlier, still has no NvRoot fix; that is the firm's claim, not NVIDIA's.

The two accounts conflict on one release. Stealthium says it confirmed ForgePtr root on 610.57.04, the release that closed NvRoot, and names only 615.71.09 as fixing ForgePtr; NVIDIA's bulletin lists 610.57.04 as the R610 update for both CVEs. If Stealthium is right, a host updated in August for the first flaw may still be open to the second. NVIDIA has not addressed the discrepancy.

Severity is also disputed. Stealthium's own score for NvRoot is 9.3, Critical, under CVSS 4.0, and it urges multi-tenant operators to treat it as Critical; NVIDIA's official rating remains 7.8 High. No statement from NVIDIA on the Nov. 12 disclosure could be found. Stealthium says it holds more than 25 further High or Critical findings across the AI runtime stack under responsible disclosure.