NVIDIA GPU Driver Kernel Use-After-Free Allows Container Escape and Privilege Escalation
Overview
NVIDIA released a security update addressing a high-severity use-after-free vulnerability in the kernel mode layer of their GPU driver. The vulnerability, identified as CVE-2026-21513, can be triggered by a user-mode client sending a specially crafted sequence of API calls to the driver. When processing these calls, a flaw in memory management could cause the kernel driver to reference a pointer to memory that has already been freed. An attacker with access to the GPU, even from within a sandboxed environment like a Docker container with GPU passthrough, could exploit this. A successful exploit could lead to denial of service (crashing the host machine) or, more critically, arbitrary code execution with kernel-level privileges. This would allow a malicious process, such as a compromised ML model training script, to escape its container and gain full control over the host operating system. This type of vulnerability is particularly dangerous in multi-tenant GPU cloud environments, where multiple customers run containerized workloads on shared hardware. The update addresses the issue by improving memory allocation and validation within the driver's kernel components.
Affected Systems
Testing Guide
1. On Windows, open the NVIDIA Control Panel, go to 'Help' -> 'System Information' to check your installed driver version. 2. On Linux, run the command `nvidia-smi` in the terminal. The driver version will be displayed in the top right corner. 3. Compare your installed version against the patched versions (555.10 for Windows, 550.40.10 for Linux). If your version is lower, your system is vulnerable and should be updated.
Mitigation Steps
1. **Update Drivers:** Immediately update all NVIDIA drivers on affected systems to the versions specified in the NVIDIA security bulletin, or newer. 2. **Restrict GPU Access:** In multi-tenant environments, avoid sharing physical GPUs between untrusted tenants. Use virtualization technologies like SR-IOV where possible. 3. **Use Hardened Containers:** For running untrusted AI workloads, use container runtimes with stronger isolation boundaries, such as gVisor or Kata Containers, to provide an additional layer of defense against kernel exploits. 4. **Monitor Host Systems:** Implement host-based intrusion detection systems (HIDS) to monitor for anomalous behavior or privilege escalation attempts originating from GPU workloads.
Patch Details
Patches are available in NVIDIA driver versions 555.10 (Windows) and 550.40.10 (Linux) and later.