Privilege Escalation in NVIDIA Container Toolkit Allows GPU Workload Escape
Overview
A high-severity privilege escalation vulnerability was found in the NVIDIA Container Toolkit and associated kernel-mode driver. The vulnerability, tracked as CVE-2026-11945, allowed a process within a container with GPU access to escape to the host operating system and gain root privileges. The flaw existed in the driver's handling of CUDA Unified Memory access from containerized processes. A malicious actor could craft a specific sequence of CUDA memory allocation and mapping calls that triggers a race condition in the host driver's IOMMU page table management. This race condition could be exploited to corrupt host kernel memory, allowing the attacker to bypass container isolation boundaries. This is particularly dangerous for multi-tenant AI/ML cloud platforms and on-premise Kubernetes clusters that rely on containers to securely isolate workloads from different users sharing a single physical GPU. An attacker with the ability to run code in one container could potentially take over the entire node, access data from other users' workloads, or use the compromised node to move laterally within the network. NVIDIA has released updated drivers and a new version of the container toolkit to address the vulnerability.
Affected Systems
Testing Guide
1. Check the installed NVIDIA driver version on your host systems using `nvidia-smi`. 2. Check the installed version of the NVIDIA Container Toolkit using `apt show nvidia-container-toolkit` or equivalent package manager command. 3. If your versions are lower than the patched versions (555.42.02 for the driver, 1.15.2 for the toolkit), you are vulnerable. 4. Proof-of-concept exploit code has been released by the researchers; running it in a test environment against a vulnerable host will result in a root shell being spawned on the host node.
Mitigation Steps
1. **Update NVIDIA Drivers:** Immediately update all host nodes to NVIDIA GPU Driver version 555.42.02 or newer. 2. **Update Container Toolkit:** Upgrade the `nvidia-container-toolkit` on all nodes to version 1.15.2 or later. 3. **Apply Principle of Least Privilege:** Do not grant GPU access to containers that do not explicitly require it. 4. **Use gVisor or Kata Containers:** For workloads requiring stronger isolation, consider using sandboxed container runtimes like gVisor or Kata Containers, which provide an additional layer of kernel isolation, although this may come with a performance penalty. 5. **Monitor for Anomalous GPU Activity:** Implement monitoring for unusual CUDA API calls or unexpected kernel panics on GPU nodes.
Patch Details
Patched in NVIDIA Driver 555.42.02 and nvidia-container-toolkit 1.15.2.