NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller size causes data to be lost in the conversion, which may lead to denial of service or information disclosure.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4752 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4752-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     August 24, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nvidia-graphics-drivers     Version        : 535.309.01-0+deb11u1     CVE ID         : CVE-2022-21813 CVE-2022-21814 CVE-2022-28181 CVE-2022-28183                      CVE-2022-28184 CVE-2022-28185 CVE-2022-28191 CVE-2022-28192                      CVE-2022-31607 CVE-2022-31608 CVE-2022-31615 CVE-2022-34670                      CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679                      CVE-2022-34680 CVE-2022-34682 CVE-2022-34684 CVE-2022-42254                      CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258                      CVE-2022-42259 CVE-2022-42260 CVE-2022-42261 CVE-2022-42262                      CVE-2022-42263 CVE-2022-42264 CVE-2022-42265 CVE-2023-0180                      CVE-2023-0183 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187                      CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191                      CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199                      CVE-2023-25515 CVE-2023-25516 CVE-2023-31022 CVE-2024-0074                      CVE-2024-0075 CVE-2024-0078 CVE-2024-0090 CVE-2024-0092                      CVE-2024-0126 CVE-2024-0131 CVE-2024-0147 CVE-2024-0149                      CVE-2024-0150 CVE-2025-23244 CVE-2025-23279 CVE-2025-23280                      CVE-2025-23282 CVE-2025-23286 CVE-2025-23300 CVE-2025-23330                      CVE-2025-23332 CVE-2025-23345 CVE-2025-33219     Debian Bug     : 1004847 1011140 1012514 1012713 1012815 1013462 1014283 1016614 1016621 1020761 1021958     1022165 1025279 1025883 1027790 1028259 1028496 1030336 1030981 1031080 1031185 1032647 1033418 1033602     1033774 1037468 1038006 1039678 1041991 1042081 1050809 1050935 1053562 1055136 1055503 1056384 1056557     1057078 1058081 1059339 1059581 1059590 1061269 1061597 1062281 1062932 1063363 1063881 1063910 1064194     1064983 1072142 1072722 1072792 1073744 1074350 1077841 1078424 1078425 1078462 1078489 1081314 1082725     1084844 1085968 1089513 1089811 1092957 1093246 1093908 1094903 1095032 1104068 1109907 1118679

    The update of nvidia-graphics-drivers for Debian 11 (bullseye) updates the     NVIDIA driver from version 470.256.02 to 535.309.01. The update addresses     numerous security vulnerabilities affecting the NVIDIA driver stack.

    Alongside the driver update, the auxiliary packages nvidia-settings and     nvidia-modprobe have also been updated to 535.309.01-0+deb11u1, as these     are required by the newer driver.

    For the detailed security status of nvidia-graphics-drivers and details about     the vulnerabilities, please refer to     https://security-tracker.debian.org/tracker/nvidia-graphics-drivers

    For Debian 11 bullseye, these problems have been fixed in version     535.309.01-0+deb11u1.

    We recommend that you upgrade your nvidia-graphics-drivers packages.

    For the detailed security status of nvidia-graphics-drivers please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nvidia-graphics-drivers

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller     size causes data to be lost in the conversion, which may lead to denial of service or information     disclosure. (CVE-2022-34670)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202310-02 (NVIDIA Drivers: Multiple Vulnerabilities)

  - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode     layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which user-mode clients can access legacy     privileged APIs, which may lead to denial of service, escalation of privileges, and information     disclosure. (CVE-2021-1052)

  - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode     layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which improper validation of a user pointer may     lead to denial of service. (CVE-2021-1053)

  - NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer     (nvidia.ko) in which it does not completely honor operating system file system permissions to provide GPU     device-level isolation, which may lead to denial of service or information disclosure. (CVE-2021-1056)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer     (nvlddmkm.sys) handler for control calls where the software reads or writes to a buffer by using an index     or pointer that references a memory location after the end of the buffer, which may lead to data tampering     or denial of service. (CVE-2021-1090)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver     contains an assert() or similar statement that can be triggered by an attacker, which leads to an     application exit or other behavior that is more severe than necessary, and may lead to denial of service     or system crash. (CVE-2021-1093)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer     (nvlddmkm.sys) handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service     or information disclosure. (CVE-2021-1094)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer     (nvlddmkm.sys) handlers for all control calls with embedded parameters where dereferencing an untrusted     pointer may lead to denial of service. (CVE-2021-1095)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where     an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted     shader, which may lead to code execution, denial of service, escalation of privileges, information     disclosure, and data tampering. The scope of the impact may extend to other components. (CVE-2022-28181)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where     an unprivileged regular user can cause an out-of-bounds read, which may lead to denial of service and     information disclosure. (CVE-2022-28183)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer     (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular user can access administrator-     privileged registers, which may lead to denial of service, information disclosure, and data tampering.
    (CVE-2022-28184)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an     unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data     tampering. (CVE-2022-28185)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a     local user with basic capabilities can cause improper input validation, which may lead to denial of     service, escalation of privileges, data tampering, and limited information disclosure. (CVE-2022-31607)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file,     where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code     execution, denial of service, escalation of privileges, information disclosure, and data tampering.
    (CVE-2022-31608)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user     with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
    (CVE-2022-31615)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a     local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of     service. (CVE-2022-34666)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller     size causes data to be lost in the conversion, which may lead to denial of service or information     disclosure. (CVE-2022-34670)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.
    (CVE-2022-34673, CVE-2022-42255)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a     helper function maps more physical pages than were requested, which may lead to undefined behavior or an     information leak. (CVE-2022-34674)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     out-of-bounds read may lead to denial of service, information disclosure, or data tampering.
    (CVE-2022-34676)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     unprivileged regular user can cause an integer to be truncated, which may lead to denial of service or     data tampering. (CVE-2022-34677)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where     an unprivileged user can cause a null-pointer dereference, which may lead to denial of service.
    (CVE-2022-34678)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     unhandled return value can lead to a null-pointer dereference, which may lead to denial of service.
    (CVE-2022-34679)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     integer truncation can lead to an out-of-bounds read, which may lead to denial of service.
    (CVE-2022-34680)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged regular user can cause a null-pointer dereference, which may lead to denial of service.
    (CVE-2022-34682)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an off-by-one error may lead to data tampering or information disclosure. (CVE-2022-34684)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an out-of-bounds array access may lead to denial of service, data tampering, or information disclosure.
    (CVE-2022-42254)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow in index validation may lead to denial of service, information disclosure, or data     tampering. (CVE-2022-42256)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow may lead to information disclosure, data tampering or denial of service.
    (CVE-2022-42257)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow may lead to denial of service, data tampering, or information disclosure.
    (CVE-2022-42258)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow may lead to denial of service. (CVE-2022-42259)

  - NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where     an unauthorized user in the guest VM can impact protected D-Bus endpoints, which may lead to code     execution, denial of service, escalation of privileges, information disclosure, or data tampering.
    (CVE-2022-42260)

  - NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input     index is not validated, which may lead to buffer overrun, which in turn may cause data tampering,     information disclosure, or denial of service. (CVE-2022-42261)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     Integer overflow may lead to denial of service or information disclosure. (CVE-2022-42263)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data     tampering, data loss, information disclosure, or denial of service. (CVE-2022-42264)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow may lead to information disclosure or data tampering. (CVE-2022-42265)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in a kernel mode layer handler, which may     lead to denial of service or information disclosure. (CVE-2023-0180)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler,     where memory permissions are not correctly checked, which may lead to denial of service and data     tampering. (CVE-2023-0181)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an out-of-     bounds write can lead to denial of service and data tampering. (CVE-2023-0183)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler     which may lead to denial of service, escalation of privileges, information disclosure, and data tampering.
    (CVE-2023-0184)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign     conversion issuescasting an unsigned primitive to signed may lead to denial of service or information     disclosure. (CVE-2023-0185)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler,     where an out-of-bounds read can lead to denial of service. (CVE-2023-0187)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler,     where an unprivileged user can cause improper restriction of operations within the bounds of a memory     buffer cause an out-of-bounds read, which may lead to denial of service. (CVE-2023-0188)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler which may     lead to code execution, denial of service, escalation of privileges, information disclosure, and data     tampering. (CVE-2023-0189)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a NULL     pointer dereference may lead to denial of service. (CVE-2023-0190)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler,     where an out-of-bounds access may lead to denial of service or data tampering. (CVE-2023-0191)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer driver,     where an invalid display configuration may lead to denial of service. (CVE-2023-0194)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver     nvlddmkm.sys, where an can cause CWE-1284, which may lead to hypothetical Information leak of unimportant     data such as local variable data of the driver (CVE-2023-0195)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where improper     restriction of operations within the bounds of a memory buffer can lead to denial of service, information     disclosure, and data tampering. (CVE-2023-0198)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler,     where an out-of-bounds write can lead to denial of service and data tampering. (CVE-2023-0199)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller     size causes data to be lost in the conversion, which may lead to denial of service or information     disclosure. (CVE-2022-34670)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged regular user can cause the use of an out-of-range pointer offset, which may lead to data     tampering, data loss, information disclosure, or denial of service. (CVE-2022-42264)

  - NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input     index is not validated, which may lead to buffer overrun, which in turn may cause data tampering,     information disclosure, or denial of service. (CVE-2022-42262)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3418 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3418-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     May 11, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nvidia-graphics-drivers-legacy-390xx     Version        : 390.157-1~deb10u1     CVE ID         : CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677                      CVE-2022-34680 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259     Debian Bug     : 1025281

    NVIDIA has released a software security update for the NVIDIA GPU Display     Driver R390 linux driver branch. This update addresses issues that may lead to     denial of service, escalation of privileges, information disclosure, data     tampering or undefined behavior.


    CVE-2022-34670

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where an unprivileged regular user can         cause truncation errors when casting a primitive to a primitive of         smaller size causes data to be lost in the conversion, which may         lead to denial of service or information disclosure.

    CVE-2022-34674

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where a helper function maps more         physical pages than were requested, which may lead to undefined         behavior or an information leak.

    CVE-2022-34675

        NVIDIA Display Driver for Linux contains a vulnerability in the         Virtual GPU Manager, where it does not check the return value from a         null-pointer dereference, which may lead to denial of service.

    CVE-2022-34677

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where an unprivileged regular user can         cause an integer to be truncated, which may lead to denial of         service or data tampering.

    CVE-2022-34680

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where an integer truncation can lead to         an out-of-bounds read, which may lead to denial of service.

    CVE-2022-42257

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer (nvidia.ko), where an integer overflow may lead to         information disclosure, data tampering or denial of service.

    CVE-2022-42258

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer (nvidia.ko), where an integer overflow may lead to         denial of service, data tampering, or information disclosure.

    CVE-2022-42259

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer (nvidia.ko), where an integer overflow may lead to         denial of service.

    For Debian 10 buster, these problems have been fixed in version     390.157-1~deb10u1.

    We recommend that you upgrade your nvidia-graphics-drivers-legacy-390xx packages.

    For the detailed security status of     nvidia-graphics-drivers-legacy-390xx please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/nvidia-graphics-drivers-legacy-390xx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller     size causes data to be lost in the conversion, which may lead to denial of service or information     disclosure. (CVE-2022-34670)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     out-of-bounds read may lead to denial of service, information disclosure, or data tampering.
    (CVE-2022-34676)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an     Integer overflow may lead to denial of service or information disclosure. (CVE-2022-42263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
339047	Debian dla-4752 : firmware-nvidia-gsp - security update	Nessus	Debian Local Security Checks	Local	critical
249616	Linux Distros Unpatched Vulnerability : CVE-2022-34670	Nessus	Misc.	Local	high
182438	GLSA-202310-02 : NVIDIA Drivers: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
181414	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (November 2022)	Nessus	Misc.	Local	high
175576	Debian dla-3418 : libegl-nvidia-legacy-390xx0 - security update	Nessus	Debian Local Security Checks	Local	high
168369	NVIDIA Linux GPU Display Driver (Nov 2022)	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2022-34670

high

Tenable Plugins

critical

high

critical

high

high

high