NVIDIA Linux GPU Display Driver (nvidia.ko): Nvidia.ko does not fully honour filesystem permissions when providing GPU

Impact

Nvidia.ko does not fully honour filesystem permissions when providing GPU device-level isolation. This is the one that matters for containerised GPU fleets - it means the device-node permission model your container runtime relies on to give each container only its assigned GPUs is not actually enforced by the driver, so a container can reach GPUs it was not allocated. On a shared Kubernetes GPU node running multiple tenants' pods, that is a straight isolation break between tenants. Debian and Gentoo both shipped it as a security update, so distro-packaged fleets are in scope.

Who can reach it

Any container or local user on a Linux GPU host with access to some subset of the NVIDIA device nodes - which is every GPU workload.

What to do

Install the fixed Linux GPU Display Driver branch. nvidia.ko / nvidia-uvm.ko cannot be replaced while any process holds a GPU, so plan a node drain: cordon the node, stop every CUDA job and GPU container, unload the modules or reboot, install, reload. Container runtimes that bind-mount the driver libraries (nvidia-container-toolkit) need restarting so running pods pick up the new userspace. No firmware flash. On multi-tenant nodes, do not treat device-node permissions or the container toolkit's device isolation as a security boundary until the driver is patched; one tenant per node or MIG-backed partitioning is the only reliable interim control.

References