NVIDIA CUDA Driver Out-of-Bounds Write Vulnerability Allows for Container Escape and Host Privilege Escalation
Overview
NVIDIA released a security bulletin addressing a high-severity out-of-bounds write vulnerability in the CUDA driver kernel module. The flaw, identified as CVE-2026-28215, resides in the driver's memory mapping component responsible for handling CUDA Unified Memory allocations. A malicious actor with access to execute code within a GPU-enabled container (e.g., by running a malicious ML model training script) can craft a specific sequence of memory allocation and access patterns. This sequence triggers an integer overflow when calculating memory offsets, leading to an out-of-bounds write in the host's kernel memory. Successful exploitation allows an attacker to overwrite critical kernel data structures. This can be leveraged to corrupt memory pointers and achieve arbitrary code execution in the context of the host kernel, effectively escaping the container and gaining full root privileges on the host machine. The vulnerability affects a wide range of NVIDIA drivers across both Linux and Windows operating systems and is particularly dangerous in multi-tenant GPU cloud environments where different users share the same physical hardware. A proof-of-concept was developed by security firm Project Zero, demonstrating the ability to crash the host system (Denial of Service) and, with further effort, achieve reliable code execution.
Affected Systems
Testing Guide
1. **Check Driver Version**: On a Linux host, run `nvidia-smi` to check the installed driver version. Compare it against the patched version (550.90.07). 2. **Check for Updates**: Use the system's package manager (e.g., `apt`, `yum`) or the official NVIDIA CUDA Toolkit installer to check for available driver updates. 3. **Use a Vulnerability Scanner**: Run a host-level vulnerability scanner (e.g., Trivy, Nessus) that has been updated with the definition for CVE-2026-28215 to automatically detect affected systems.
Mitigation Steps
1. **Update NVIDIA Drivers**: Immediately update all host systems with NVIDIA GPUs to the patched driver versions specified in the NVIDIA security bulletin (550.90.07 for Linux, 552.82 for Windows, or newer). 2. **Use gVisor or Kata Containers**: For untrusted GPU workloads, use stronger container isolation technologies like gVisor or Kata Containers, which provide an additional kernel layer that can mitigate container escape vulnerabilities. 3. **Restrict GPU Access**: Limit direct access to GPU resources to only trusted users and workloads. Implement strict scheduling and resource quota policies in Kubernetes or other orchestration platforms. 4. **Monitor for Anomalous GPU Activity**: Use system monitoring tools to detect unusual GPU memory usage patterns or unexpected kernel panics, which could indicate an exploitation attempt.
Patch Details
Patched in Linux driver version 550.90.07 and Windows driver version 552.82.