NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An unprivileged user drives the kernel to use
Impact
An unprivileged user drives the kernel to use an out-of-range pointer offset, producing data corruption, data loss, kernel information disclosure or a crash. Everything with a GPU allocation on the node can reach this, because /dev/nvidia* is handed straight into every GPU container by the container toolkit - there is no additional gate between a tenant workload and the driver ioctl surface.
Who can reach it
Local and unprivileged. The attacker needs only to open /dev/nvidiactl and /dev/nvidia<N> and issue ioctls. On a shared node that is any scheduled tenant pod holding a GPU; no host shell, no root, no CAP_SYS_ADMIN.
What to do
Move to the fixed datacenter driver branch named in NVIDIA bulletin 5415. Cost: nvidia.ko cannot be replaced while a process holds a GPU, so this is cordon + drain + module reload per node - stop persistence mode and nv-hostengine/DCGM first or the unload fails. With the GPU Operator it is a rolling node upgrade. No VBIOS, BMC or SBIOS flash needed.
References
Related entries
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An unprivileged user triggers an integer overflowCVE-2023-25516 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)High
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): A race condition in the Linux display driver is winnableCVE-2025-23282 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)High
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): A kernel helper maps more physical pages than wereCVE-2022-34674 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An unprivileged local user gets limited write accessCVE-2022-21813 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An unprivileged local user gets limited write accessCVE-2022-21814 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): A basic local user triggers a null-pointer dereferenceCVE-2022-31615 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.