CVE-2026-20908 describes a TOCTOU race condition in the Intel NPU Driver for Windows operating in Ring 1. An unprivileged authenticated local adversary can exploit this race condition to cause a denial of service. The attack complexity is high and does not require user interaction. The vulnerability affects all versions of the driver within Ring 1, but no specific affected versions are detailed. The CVSS 3.1 base score is 5.3, reflecting medium severity with local attack vector, high attack complexity, low privileges required, no user interaction, and impacts limited to availability (high) and integrity (low) with no confidentiality impact.

The vulnerability allows a local, authenticated attacker with low privileges to cause denial of service, impacting system availability significantly. There is no impact on confidentiality and only a low impact on integrity. No further impacts on confidentiality, integrity, or availability are expected beyond the initial denial of service.

No patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the high attack complexity and requirement for local authenticated access, immediate risk is moderated, but monitoring vendor updates for patches is recommended.