PatchTheCVEnvidia gpu operator vulnerabilities and fixes
Recent CVEs affecting nvidia gpu operator, with upgrade or downgrade steps. 7 tracked.
Also searched as: nvidiagpuoperator.
nvidia gpu operator has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-02-12. Highest priority: CVE-2025-23359 (score 61/100).
- CVE-2025-23359 HIGH 8.3 UPGRADE UPGRADE NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with
- CVE-2024-0137 MEDIUM 5.5 UPGRADE UPGRADE NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container imag
- CVE-2024-0136 HIGH 7.6 UPGRADE UPGRADE NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container imag
- CVE-2024-0135 HIGH 7.6 UPGRADE UPGRADE NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container imag
- CVE-2024-0134 MEDIUM 4.1 UPGRADE UPGRADE NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially craf
- CVE-2024-0133 MEDIUM 4.1 UPGRADE UPGRADE NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing
- CVE-2024-0132 CRITICAL 9.0 UPGRADE UPGRADE NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when us
FAQ
How do I fix nvidia gpu operator vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nvidia gpu operator being exploited right now?
None of the tracked nvidia gpu operator CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nvidia gpu operator CVE should I patch first?
CVE-2025-23359 currently ranks highest (61/100): NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with .