Description
The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x before R346.22, Linux for Tegra (L4T) driver before R21.2, and Chrome OS driver before R40 allows remote attackers to cause a denial of service (segmentation fault and X server crash) or possibly execute arbitrary code via a crafted GLX indirect rendering protocol request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nvidia-graphics-drivers | 340.65-1 | — |
| Debian 13 | nvidia-graphics-drivers | 340.65-1 | — |
| Debian 12 | nvidia-graphics-drivers | 340.65-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nvidia-graphics-drivers-304 +1 | 304.125-0ubuntu0.0.1 | USN-2438-1 |
| Ubuntu 14.04 LTS | nvidia-graphics-drivers-331 +1 | 331.113-0ubuntu0.0.4 | USN-2438-1 |
Advisories 1
- USN-2438-1 nvidia-graphics-drivers-304, nvidia-graphics-drivers-304-updates, nvidia-graphics-drivers-331, nvidia-graphics-drivers-331-updates vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026