Nvidia patched 114 GPU driver flaws on September 30, and one is rated 9.9

Image: Nvidia

Nvidia published a security bulletin on September 30 covering 114 CVE identifiers across its GPU display driver and its vGPU software, and exactly one of them is rated Critical, at 9.9. The 9.9 is not in the driver a PC VR rig runs: Nvidia’s bulletin places CVE-2026-47574 in “NVIDIA vGPU Virtual GPU Manager for Linux”.

Valve’s warning about Nvidia’s 580 branch concerns Steam Link VR on Linux, which is a separate problem from the flaws in this bulletin. Image: Valve

Nvidia describes that one as a case where “an attacker could cause incorrect resource transfer between spheres”, with the impacts given as code execution, denial of service, escalation of privileges, information disclosure and data tampering. Most of the display-driver entries are rated 7.8 High with the same list of impacts.

vGPU and the display driver are different products

vGPU software is the virtualisation stack that splits a data-centre GPU between virtual machines, and that is where the 9.9 sits. The display driver is the thing a GeForce or RTX card runs on a desktop, and its entries are mostly kernel-mode memory bugs: out-of-bounds writes and reads, use-after-free, integer overflows, and…