NVIDIA GPU Display Driver kernel mode layer (nvidia.ko on Linux, nvlddmkm.sys on Windows): A tenant can drive the GPU

Impact

A tenant can drive the GPU into an interrupt storm and wedge the node. All driver versions were affected. The reason this belongs in an AI-datacenter catalogue despite being 'only' a DoS is the shape of the failure: one tenant's workload saturates the host's interrupt handling and every other job on that machine - including jobs on the other seven GPUs - stalls or dies. There is no per-tenant quota on GPU interrupt generation, so this is a noisy-neighbour attack with node-wide blast radius and no scheduler-level control that limits it.

Who can reach it

Local, unprivileged - any workload with a GPU handle on the node. Works from inside a container with the GPU mapped in.

What to do

Update the NVIDIA driver to a fixed branch. Requires draining the node so nvidia.ko can be unloaded. Because the practical exposure is availability rather than confidentiality, the compensating control worth building is detection: watch per-node interrupt rates and GPU health counters and attribute spikes back to the owning tenant, so the same tenant cannot repeat it unnoticed across the fleet.

References