Yes, if your NVIDIA Container Toolkit is v1.16.1 or earlier on Linux. NVIDIA's bulletin lists v1.16.2 as the fixed release, and also lists GPU Operator 24.6.1 and earlier as affected, with 24.6.2 as the fix. The flaw is a time of check to time of use issue that can expose the host file system.
What the bulletin says
NVIDIA describes CVE-2024-0132 as a critical issue, scored 9.0 under CVSS v3.1, classed as a time of check to time of use flaw (CWE-367). In the default configuration, a specially crafted container image can gain access to the host file system. The listed impacts include code execution, denial of service, privilege escalation, information disclosure and data tampering.
The bulletin also states that the issue does not affect use cases where CDI is used. CDI is the Container Device Interface, a way of describing devices to the container runtime. NVIDIA adds that its base score is an average across many systems and tells you to assess the risk for your own configuration.
Why this matters for ML teams: the toolkit is the piece that lets a container see the GPU. It sits at the boundary between an image someone built and the host that runs it. Teams that pull community images for training or inference are exactly the group that should care about that boundary.
How to check a host
- List every GPU host, including cloud instances and any shared lab machines.
- On each one, ask the package manager for the installed version of the toolkit packages.
- Compare with v1.16.2. Anything at v1.16.1 or earlier needs an update.
- For Kubernetes, check the GPU Operator version against 24.6.2.
- Record whether the host uses CDI, since the bulletin says that case is not affected.
The install guide for the toolkit names these packages: nvidia-container-toolkit, nvidia-container-toolkit-base, libnvidia-container-tools and libnvidia-container1. At the time of writing, the guide pins its example to version 1.20.1-1, so a current install is well past the vulnerable range.
What to do after updating
An update closes the specific flaw. It does not answer the broader question of which images your GPU hosts will run. A few habits help:
- Run only images from sources you track, and pin them by digest.
- Keep GPU hosts in their own network segment, away from data stores holding raw training data.
- Avoid running containers as root and avoid privileged mode unless there is a written reason.
- Remove cached credentials from GPU hosts that many people share.
After updating the toolkit, restart the container runtime as the install guide directs, then confirm a test container still sees the GPU.
Keep it from drifting back
GPU hosts are often built once from an image and rarely touched. Add the toolkit version to your asset inventory, and alert when a host falls below the fixed version. Safeguard asset discovery and dependency scanning can help you keep track of what runs where, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Does a newer GPU driver fix this?
The bulletin names the Container Toolkit and GPU Operator versions as the fix. The driver is a separate component, so update the toolkit.
Are we safe if we use CDI?
NVIDIA says the issue does not impact CDI use cases. Still update, because you may not use CDI on every host.
Sources
Last reviewed: 19 October 2026.
