Introduction
Organizations that use the .run installer to manage NVIDIA GPU drivers on Linux and Solaris face a real privilege escalation risk. An attacker with local access can exploit a race condition in the installer to gain root privileges, which may lead to code execution, data tampering, or denial of service. NVIDIA disclosed the vulnerability, tracked as CVE-2025-23279, in its July 2025 security bulletin. It affects a wide range of driver versions distributed via the .run installer.
NVIDIA is the dominant vendor of discrete graphics hardware, and its GPUs run in everything from consumer desktops to high-performance computing clusters. GPU acceleration on Linux and Solaris depends on its proprietary drivers, so a flaw in the way those drivers are installed has a wide impact across industries.
Technical Information
CVE-2025-23279 is a race condition vulnerability in the NVIDIA .run Installer for Linux and Solaris. The installer is a self-extracting binary that performs privileged operations: extracting driver files, compiling kernel modules, and moving files into system directories. During these operations, it creates and manipulates temporary files and directories with elevated privileges.
The vulnerability arises because the installer does not properly synchronize access to these temporary files. If an attacker with local access can predict or monitor the creation of these files, they can replace or manipulate them before the installer processes them with root privileges. In this classic time-of-check to time-of-use (TOCTOU) flaw, the attacker injects malicious content or symlinks and gets arbitrary code execution as root. The attack requires precise timing, but it can be automated for higher reliability.
The flaw is classified under CWE-367 (Race Condition). It affects the .run installer mechanism specifically, not distribution-packaged drivers. An attacker can exploit it only during driver installation or upgrade, and only with local access to the system.
Patch Information
NVIDIA has fixed CVE-2025-23279 in its July 2025 security update. The fix adds proper synchronization to the .run installer, so the race condition can no longer be used for privilege escalation. Users should update their NVIDIA GPU Display Drivers to the latest version on the NVIDIA Driver Downloads page. The update is included in this advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5670
Affected Systems and Versions
- NVIDIA .run Installer for Linux and Solaris
- Affects driver versions distributed via the .run installer prior to the July 2025 security update
- Confirmed affected packages include nvidia-graphics-drivers-tesla and nvidia-open-gpu-kernel-modules on Debian
- Vulnerable configurations: Any system where the .run installer is used for driver installation or upgrade
Vendor Security History
NVIDIA has fixed privilege escalation and race condition vulnerabilities in its driver stack before. Past issues have included improper privilege checks and memory management flaws in both its Linux and Windows drivers. The company typically issues coordinated security bulletins with timely patches, and its advisories are detailed, with specific version guidance.
