NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): Another integer overflow path in nvidia.ko reachable

Impact

Another integer overflow path in nvidia.ko reachable by any local GPU user. Everything with a GPU allocation on the node can reach this, because /dev/nvidia* is handed straight into every GPU container by the container toolkit - there is no additional gate between a tenant workload and the driver ioctl surface.

Who can reach it

Local and unprivileged. The attacker needs only to open /dev/nvidiactl and /dev/nvidia<N> and issue ioctls. On a shared node that is any scheduled tenant pod holding a GPU; no host shell, no root, no CAP_SYS_ADMIN.

What to do

Move to the fixed datacenter driver branch named in NVIDIA bulletin 5415. Cost: nvidia.ko cannot be replaced while a process holds a GPU, so this is cordon + drain + module reload per node - stop persistence mode and nv-hostengine/DCGM first or the unload fails. With the GPU Operator it is a rolling node upgrade. No VBIOS, BMC or SBIOS flash needed.

References