NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): A null-pointer dereference in the Linux display driver
Impact
A null-pointer dereference in the Linux display driver crashes the node from an unprivileged local account. Everything with a GPU allocation on the node can reach this, because /dev/nvidia* is handed straight into every GPU container by the container toolkit - there is no additional gate between a tenant workload and the driver ioctl surface.
Who can reach it
Local and unprivileged. The attacker needs only to open /dev/nvidiactl and /dev/nvidia<N> and issue ioctls. On a shared node that is any scheduled tenant pod holding a GPU; no host shell, no root, no CAP_SYS_ADMIN.
What to do
Move to the fixed datacenter driver branch named in NVIDIA bulletin 5703. Cost: nvidia.ko cannot be replaced while a process holds a GPU, so this is cordon + drain + module reload per node - stop persistence mode and nv-hostengine/DCGM first or the unload fails. With the GPU Operator it is a rolling node upgrade. No VBIOS, BMC or SBIOS flash needed.
References
Related entries
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An off-by-one error in nvidia.ko permits data tamperingCVE-2022-34684 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An out-of-bounds array access in nvidia.ko givesCVE-2022-42254 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): A second out-of-bounds array access path in nvidia.koCVE-2022-42255 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): An integer overflow in index validation defeatsCVE-2022-42256 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver (nvidia.ko): integer overflow in the kernel mode layer reachable by a local GPU userCVE-2022-42257 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
- NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko): A null-pointer dereference in a Linux driver kernelCVE-2025-23332 · NVIDIA GPU Display Driver - Linux kernel module (nvidia.ko)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.