Nvidia patched 114 GPU driver flaws on September 30, and the worst is rated 7.8
Nvidia published a security bulletin on September 30 covering 114 CVE identifiers across its GPU display driver and its vGPU software, and none of them is rated Critical. The highest base score in the bulletin is 7.8, and Nvidia's bulletin places CVE-2026-47574, one of the flaws at that score, in "NVIDIA vGPU Virtual GPU Manager for Linux" rather than in the driver a PC VR rig runs.
Valve's warning about Nvidia's 580 branch concerns Steam Link VR on Linux, which is a separate problem from the flaws in this bulletin. Image: Valve
Nvidia describes that one as a case where "an attacker could cause incorrect resource transfer between spheres", with the impacts given as code execution, denial of service, escalation of privileges, information disclosure and data tampering. Most of the display-driver entries are rated 7.8 High with the same list of impacts.
vGPU and the display driver are different products
vGPU software is the virtualisation stack that splits a data-centre GPU between virtual machines, and that is where CVE-2026-47574 sits. The display driver is the thing a GeForce or RTX card runs on a desktop, and its entries are mostly kernel-mode memory bugs: out-of-bounds writes and reads, use-after-free, integer overflows, and read-only memory whose permissions are not preserved.
Nvidia credits outside researchers for most of them, among them a Seoul National University security group, Xiaomi's ShadowBlade Security Lab and the TrendAI Zero Day Initiative. Nvidia does not say that any of the 114 has been exploited.
Every entry needs access to the machine
The CVSS v3.1 vectors Nvidia publishes are local, with two listed as physical, so none of the 114 is a remote drive-by. An attacker needs to be running code on the machine, or standing in front of it, before any of this is reachable.
Nvidia's own caution on its scores is that the "risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk to your local installation", and that it recommends evaluating the risk to your specific configuration.
The patched Linux R580 build is in the branch Valve flagged
For Linux GeForce drivers, Nvidia lists R580 as fixed in 580.178.04 and every earlier version as affected, along with 595.91.07 on R595, 610.57.04 on R610 and 615.71.09 on R615. On Windows, GeForce lands at 582.78 on R580, 610.60 on R610 and 616.56 on R615, with no R595 entry at all. Two of the 68 R610 rows give 610.88 instead, which is the figure the bulletin uses for the RTX, Quadro, NVS and Tesla lines.
R580 is the branch Valve confirmed on September 30 breaks Steam Link VR on Linux. That is a functional regression rather than one of these flaws, and the two problems only share a branch: Nvidia's bulletin does not mention VR, headsets, SteamVR or Steam Link.
Nvidia lists the fixed versions and leaves the judgement to you
Nvidia's instruction is "To protect your system, download and install the latest drivers referenced in the Security Updates sections of this bulletin." Which of the 114 entries applies to a given machine depends on the branch it is on, because Nvidia addresses a different set in each.
On a Linux VR host a driver change is its own small operation. Valve says mismatched Nvidia driver files land SteamVR on error 303, which is what a half-finished update looks like from inside a headset.
The bulletin is dated September 30 and marked revision 01, its initial release. The fixed versions are the only action Nvidia names.
