CVE-2024-0090 is a High severity (CVSS 7.8) out of bounds write in the NVIDIA GPU driver for Windows and Linux, which can lead to code execution, denial of service, privilege escalation, information disclosure or data tampering. NVIDIA fixed it in several branch releases, such as 555.99 on Windows and 555.52.04 on Linux. Update the driver.
What's affected
- Product: NVIDIA GPU Display Driver for Windows and Linux, vGPU guest drivers, the Virtual GPU Manager and Cloud Gaming.
- Fixed Windows display drivers: R555 555.99, R550 552.55, R535 538.67, R470 475.06.
- Fixed Linux display drivers: R555 555.52.04, R550 550.90.07, R535 535.183.01, R470 470.256.02.
- Fixed vGPU guest drivers: Windows 17.2 (552.55), 16.6 (538.67), 13.11 (475.06). Linux 17.2 (550.90.07), 16.6 (535.183.01), 13.11 (470.256.02).
- Fixed Virtual GPU Manager (Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu): 17.2 (550.90.05), 16.6 (535.183.04), 13.11 (470.256.02).
- Severity: High, CVSS 7.8, local vector, low privileges. The record and the bulletin agree.
- Exploitation: the record's KEV flag is false, and the bulletin does not report exploitation.
How to check if you're exposed
Run this on Windows and Linux hosts alike:
nvidia-smi
and read the driver version. Compare it with the right row above for your operating system and branch. For vGPU, check both the host Virtual GPU Manager and the guest driver, since each has its own fixed build.
Kubernetes GPU nodes deserve a look too. The driver lives on the node, not in the application image, so a clean image scan says nothing about it.
What to do now
- Inventory GPU drivers across workstations, servers, VDI guests and GPU nodes.
- Match each to its branch and OS, then pick the fixed build from the table.
- Update drivers, and update vGPU hosts and guests together.
- Reboot where the installer requires it, and recheck with nvidia-smi.
- Add a driver version rule to your patch policy, so branches do not drift.
Why it matters
The record maps this to CWE-787 (CWE-787), out of bounds write. The driver writes data past the end of a memory buffer, which can corrupt neighboring memory. Because drivers run with high privilege, such writes tend to carry the biggest impact among bug classes.
The vector is local with low privileges, so this is a step after initial access, not a way in. Large GPU estates make it hard to patch, because drivers sit outside the usual package flow. That is why an inventory by node and branch is the first and most useful step.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Linux driver fixes CVE-2024-0090 on R550?
550.90.07, according to the NVIDIA bulletin. Other Linux fixes are 555.52.04, 535.183.01 and 470.256.02.
Do I need to patch both host and guest for vGPU?
The bulletin lists fixed builds for the Virtual GPU Manager and the guest drivers, so update both.
Sources
- NVIDIA security bulletin 5551 (vGPU and GPU display driver, June 2024)
- Safeguard Gold entry for CVE-2024-0090
Last reviewed: 19 October 2026.
