NVIDIA Linux driver bugs NvRoot and ForgePtr allow root access

Security firm Stealthium has disclosed two privilege-escalation bugs in NVIDIA Linux kernel drivers: NvRoot (CVE-2026-47591) and ForgePtr (CVE-2026-47501). Stealthium says these flaws allow an unprivileged user inside a GPU container to take root on the host machine. The researchers say the bugs have been in the code since the first open release, 515.43.04, in May 2022. Stealthium also reports that 25 more High or Critical findings regarding the NVIDIA AI runtime stack are expected to be disclosed.

Image: Hardware Busters

NVIDIA rates both issues with a 7.8 CVSS 3.1 score, though Stealthium rates NvRoot at 9.3. NVIDIA released a fix for NvRoot on August 3 in drivers 610.57.04, 595.91.07, 595.44.14, and 580.178.04. The fix for ForgePtr arrived later, on September 9, in driver 615.71.09. Stealthium notes that the R590, R575, R570, R565, and older driver branches do not have a fix for NvRoot.

Stealthium says there is no workaround for these bugs other than updating the drivers. The firm notes that while the risk is lower for home gaming PCs because an attacker needs a local account, desktop Linux users on older driver branches should update.