NVIDIA Container Toolkit Vulnerability Allows GPU-Based Container Escape
Overview
A high-severity vulnerability was discovered in the NVIDIA Container Toolkit (`nvidia-container-runtime`) that could allow a malicious container with GPU access to escape its sandbox and gain privileges on the host system. The flaw, designated CVE-2026-1048, resides in the way the runtime handles the mapping of character devices from the host into the container. An attacker with root privileges inside a container (a common scenario in ML development environments) could leverage a carefully crafted sequence of `ioctl` calls against the mapped NVIDIA device files (`/dev/nvidia*`). This manipulation leads to a race condition in the underlying kernel driver, allowing the containerized process to corrupt kernel memory associated with GPU management. A successful exploit could allow the attacker to read or write arbitrary host memory, effectively leading to a full container escape. This is particularly dangerous in multi-tenant GPU clusters, where multiple users run workloads on shared hardware. A compromise could allow one user to access, steal, or tamper with the models and data of all other users on the same physical server, undermining the security model of containerized ML infrastructure.
Affected Systems
Testing Guide
1. On a container host system, check the installed NVIDIA driver version with the command `nvidia-smi`. If the version is below `550.75`, the system is vulnerable. 2. Check the installed version of the `nvidia-container-toolkit` package using your system's package manager (e.g., `apt show nvidia-container-toolkit` or `rpm -qa | grep nvidia-container-toolkit`). If the version is below `1.15.2`, the system is vulnerable. 3. Run a security scanner that specifically checks for this CVE, such as Trivy or Grype, against your container host and relevant container images.
Mitigation Steps
1. Update the NVIDIA GPU drivers on all container hosts to version `550.75` or newer. 2. Update the `nvidia-container-toolkit` and its components (`libnvidia-container`, `nvidia-container-runtime`) to version `1.15.2` or newer. 3. In Kubernetes environments, apply strict Pod Security Standards (e.g., `restricted`) and use admission controllers like Gatekeeper or Kyverno to limit `hostPath` mounts and privileged containers. 4. Avoid running containers as the root user whenever possible. Use a non-root user inside the container image.
Patch Details
Patched in NVIDIA driver version 550.75 and NVIDIA Container Toolkit 1.15.2.