October 2025 NVIDIA GPU Display Driver Bulletin: Use-After-Free, Race Conditions, and DLL Hijacking Across the Driver Stack
Bulletin: NVIDIA GPU Display Driver — October 2025 | CVEs: CVE-2025-23280, CVE-2025-23281, CVE-2025-23282, CVE-2025-23309, CVE-2025-23330, CVE-2025-23332, CVE-2025-23345, CVE-2025-23352 | Disclosed: October 9, 2025
Researchers: Robin Bastide (Quarkslab), Sam Lovejoy and Valentina Palmiotti, Daniel Rhea, JunDong Xie (Ant Group Light-Year Security Lab), Giovanni Di Santi, Andrea Di Dio, and Cristiano Giuffrida (VU Amsterdam).
For executives
NVIDIA's October 2025 GPU display driver bulletin patched eight vulnerabilities discovered by six independent research teams. The majority affect the Linux GPU driver and cluster around memory management failures — use-after-free conditions and race conditions in the kernel mode layer. A separate Windows-specific vulnerability allows DLL hijacking without elevated privileges.
CVE-2025-23280: use-after-free in the Linux display driver (CVSS 7.0)
Discovered by Robin Bastide of Quarkslab. The driver accesses memory after it has been freed, creating a window where a local attacker with low privileges can manipulate the freed memory region. Affects Linux driver branches R580, R570, and R535.
CVE-2025-23281: use-after-free, Linux display driver
A second use-after-free in the Linux driver in a different code path. Stealthium has published a technical deep-dive including commit-level analysis of the patches NVIDIA applied in driver version 580.95.05.
See Stealthium's driver vulnerability analysis.
CVE-2025-23282: race condition in the Linux display driver
Discovered by Sam Lovejoy and Valentina Palmiotti. The attacker triggers two operations simultaneously and wins the race to manipulate shared driver state between them.
CVE-2025-23309: uncontrolled DLL loading in the Windows display driver
Discovered by Daniel Rhea. The display driver loads a DLL from a path that an unprivileged local attacker can influence. A standard user account is sufficient to place files in the target location on affected systems.
CVE-2025-23330 and CVE-2025-23332: further memory management flaws
Stealthium's analysis of CVE-2025-23332 includes the specific ioctl involved (NV_ESC_WAIT_OPEN_COMPLETE) and the kernel patch — an explicit size validation guard added in driver version 580.95.05.
See Stealthium's technical blog.
CVE-2025-23345 and CVE-2025-23352
CVE-2025-23345 discovered by JunDong Xie (Ant Group). CVE-2025-23352 discovered by a three-person team from Vrije Universiteit Amsterdam.
Patch
Update via the NVIDIA Driver Downloads page. Patched Linux driver version: 580.95.05.