NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): A specially crafted shader

Impact

A specially crafted shader causes an out-of-bounds write in the kernel mode layer, reaching code execution with a changed scope - and NVIDIA scores this AV:Network, meaning a remotely delivered shader (WebGL, a remote render session, a shared compute service) can reach it. This is the most dangerous display-driver bug in the 2022 set for anyone running remote rendering or browser-facing GPU workloads. Both the Windows and Linux datacenter drivers are affected, so a mixed fleet needs two separate rollouts.

Who can reach it

Local and unprivileged on either OS. On Linux it is reachable from any GPU container via /dev/nvidia*; on Windows from any session holding a GPU handle.

What to do

Upgrade both the Linux and the Windows datacenter driver branches listed in bulletin 5353. Cost: Linux needs a drain and nvidia.ko reload per node; Windows needs a reboot per node. Two change windows unless your fleet is homogeneous.

References