Skip to content
Fencer Vulns
high 7.8

CVE-2025-23244 json

NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions.

published 2025-05-01 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-13059

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Patch / fix

  • nvidia virtual_gpu_display_driver 16.10, 17.6, 18.1
  • nvidia virtual_gpu_graphics_driver 16.10, 17.6, 18.1
  • nvidia cloud_gaming_guest 570.133.20
  • nvidia gpu_display_driver 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia geforce 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia tesla 535.247.01, 550.163.01, 570.133.20
  • nvidia quadro 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia rtx 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia nvs 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia geforce_firmware 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia tesla_firmware 535.247.01, 550.163.01, 570.133.20
  • nvidia quadro_firmware 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia rtx_firmware 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia nvs_firmware 535.247.01, 550.163.01, 570.133.07, 575.51.02
  • nvidia-graphics-drivers Debian 12 535.247.01-1~deb12u1
  • nvidia-graphics-drivers Debian 14, Debian 13 535.247.01-1
  • nvidia-graphics-drivers-tesla Debian 12 525.147.05-6
  • nvidia-open-gpu-kernel-modules Debian 12 535.247.01-1~deb12u1
  • nvidia-open-gpu-kernel-modules Debian 13 535.247.01-1
  • nvidia-graphics-drivers-tesla-535 Debian 13 535.247.01-1

debian advisories DEBIAN-CVE-2025-23244

  • nvidia-graphics-drivers-535 Ubuntu 22.04 LTS 535.247.01-0ubuntu0.22.04.1
  • nvidia-graphics-drivers-535 Ubuntu 24.04 LTS 535.247.01-0ubuntu0.24.04.1
  • nvidia-graphics-drivers-550 Ubuntu 22.04 LTS 550.163.01-0ubuntu0.22.04.1
  • nvidia-graphics-drivers-550 Ubuntu 24.04 LTS 550.163.01-0ubuntu0.24.04.1
  • nvidia-graphics-drivers-570 Ubuntu 20.04 LTS 570.133.07-0ubuntu0.20.04.1
  • nvidia-graphics-drivers-570 Ubuntu 22.04 LTS 570.133.07-0ubuntu0.22.04.1
  • nvidia-graphics-drivers-570 Ubuntu 24.04 LTS 570.133.07-0ubuntu0.24.04.1
  • nvidia-graphics-drivers-570 Ubuntu 25.10 570.133.07-0ubuntu2

ubuntu advisories UBUNTU-CVE-2025-23244

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-23244 updated cvss 7.8

GPU: Privilege Escalation in NVIDIA GPU Display Driver for Linux

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • NVIDIA GPU Display Driver, vGPU Software, Cloud Gaming

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.