Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers (blog.quarkslab.com)

Researchers disclosed two vulnerabilities in NVIDIA’s Linux Open GPU Kernel Modules (nvidia.ko and nvidia-uvm.ko) that let a local unprivileged process trigger a kernel oops and subsequently exploit a kernel use‑after‑free to obtain kernel read/write primitives. CVE‑2025‑23300 is a null‑pointer dereference in the UVM_MAP_EXTERNAL_ALLOCATION ioctl when mapping “deviceless” memory (pGpu == NULL); NVIDIA patched dupMemory to skip GPU‑context work for deviceless allocations. CVE‑2025‑23280 is a UAF in threadStateInit()/threadStateFree(): threadState is stack‑allocated and inserted into a global red‑black tree, so an oops that frees the vmalloced kernel stack leaves dangling pointers. NVIDIA added a heap‑based threadStateAlloc used in dupMemory, but other call sites may remain vulnerable. The exploit PoC (on Ubuntu with nvidia-driver 570.86.15) shows this is practically exploitable despite modern mitigations: unlike typical kmalloc UAFs, the dangling pointer lives in the vmalloc kernel‑stack area, requiring novel shaping techniques. The authors combine aggressive fork churn (to create/free kernel stacks), v4l2 vmalloc‑backed buffers (to allocate/mmap large vmalloc regions), and a “side‑effect purge” triggered by deviceless allocations to force reuse of freed vmalloc slots, then mmap a v4l2 buffer to overlap the UAF address and gain control. Significance: many AI/ML workloads run on NVIDIA GPUs, so unprivileged local access to display/device nodes can lead to local privilege escalation on desktops and servers. Operators should apply NVIDIA’s October 2025 fixes, restrict device permissions, and audit direct ioctl access.