NVIDIA Patches High-Severity Linux Driver Flaws Exposing Sensitive Data

Key Takeaways

• NVIDIA has released a critical security update for its Infrastructure Controller software for Linux, addressing 14 vulnerabilities.
• The flaws affect versions 0 through 1.9 of the Infrastructure Controller and could lead to data exposure, code execution, data manipulation, or denial of service.
• The most severe vulnerability, CVE-2026-65113, is rated 9.8 (Critical) and involves hard-coded credentials.
• Organizations are urged to update to version 2.0 or later immediately to mitigate these risks.

NVIDIA Addresses Critical Flaws in Linux Infrastructure Controller

NVIDIA has issued a comprehensive security bulletin for its Infrastructure Controller software on Linux, patching a total of 14 vulnerabilities. These flaws could be exploited by attackers to access sensitive system information, execute arbitrary code, alter data, or disrupt operational environments.

The update, detailed in NVIDIA’s September 2026 Infrastructure Controller security release, specifically impacts software versions ranging from 0 to 1.9. NVIDIA strongly advises all affected organizations to upgrade or clone their software installations to version 2.0 or newer to resolve these reported issues.

Deep Dive into Specific Vulnerabilities

Among the vulnerabilities addressed is CVE-2026-65127, classified as a medium-severity issue with a CVSS score of 4.1. This flaw, tracked as CWE-1258, stems from the exposure of sensitive system information due to uncleared debug data.

Exploitation of CVE-2026-65127 would require an attacker to possess local access and high privileges, along with specific environmental conditions, to retrieve the exposed debugging artifacts. While this particular vulnerability demands significant attacker access, it forms part of a broader security release that includes several more critical issues.

High-Severity and Critical Vulnerabilities

The most critical vulnerability identified in this update is CVE-2026-65113, which has been assigned a CVSS score of 9.8, indicating a severe risk. NVIDIA confirmed that this flaw involves the use of hard-coded credentials within the Infrastructure Controller for Linux.

A successful exploit of CVE-2026-65113 could allow an unauthenticated, remote attacker to gain elevated privileges, manipulate data, instigate a denial-of-service condition, or disclose confidential information.

NVIDIA also rectified CVE-2026-65128, an SQL injection vulnerability rated 8.8 on the CVSS scale. Exploiting this flaw could lead to code execution, data manipulation, service disruption, and information disclosure. Notably, this vulnerability requires only low privileges and no user interaction to be exploited.

Other high-severity issues include weaknesses related to missing or improper authentication, OS command injection, and improper certificate validation.

Further addressing critical security gaps, CVE-2026-65114, with a CVSS score of 8.3, could facilitate data tampering, denial of service, and information disclosure due to a lack of proper authentication for a critical function. Similarly, CVE-2026-65121, rated 8.2, presents a risk of privilege escalation and data exposure through improper authentication.

The update also includes a fix for CVE-2026-65130, an OS command injection flaw assigned a CVSS score of 8.0. Despite requiring high privileges and exhibiting high attack complexity, a successful exploit could result in remote code execution and a complete compromise of confidentiality, integrity, and availability.

Additional remediations target two uncontrolled resource consumption vulnerabilities, CVE-2026-65115 and CVE-2026-65112, both with a CVSS score of 6.5. These issues could be exploited by an authenticated attacker to trigger denial-of-service conditions. NVIDIA also remediated vulnerabilities concerning external control of file paths, XML injection, the use of hard-coded passwords, various certificate-validation issues, and improper workflow enforcement.

Given that Infrastructure Controller deployments are often critical for managing NVIDIA infrastructure components, timely remediation of these vulnerabilities is paramount for maintaining security and operational integrity.

What You Should Do

• Identify Affected Systems: Pinpoint all systems currently running NVIDIA Infrastructure Controller versions 0 through 1.9.
• Update Immediately: Upgrade all identified instances to version 2.0 or later to apply the necessary security patches.
• Review Exposed Services: Conduct a thorough review of all exposed services within your Infrastructure Controller deployments.
• Strengthen Access Controls: Verify and enhance access controls, ensuring that only authorized personnel and processes have the necessary permissions.
• Audit Credentials: Regularly audit and update credentials, especially those that are hard-coded or default.
• Monitor Logs: Increase vigilance in monitoring system logs for any suspicious activity that might indicate attempted or successful exploitation.
• Implement Network Segmentation: Employ robust network segmentation to limit the blast radius of any potential compromise.
• Assess Local Risk: Evaluate the specific risk to your local installations, as NVIDIA’s severity ratings represent an average across varied deployments and may not fully reflect your unique configuration, user privileges, and network accessibility.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.