NVIDIA issued security updates addressing a critical vulnerability (CVE-2026-0132, CVSS 9.0) in the NVIDIA Container Toolkit and NVIDIA GPU Operator. The flaw resides in a Time-of-Check Time-of-Use (TOCTOU) file validation defect when mounting host resources into containers under default configurations. By manipulating filesystem symlinks between path validation and bind-mounting, a malicious container image can traverse boundaries and access the underlying host filesystem.

Once host filesystem access is established, adversaries can interact directly with container runtime Unix sockets, such as docker.sock or containerd.sock, executing arbitrary commands with root privileges to achieve complete node takeover. The defect impacts Container Toolkit versions 1.16.1 and earlier and GPU Operator versions 24.6.1 and earlier, though Container Device Interface (CDI) deployments are immune. While in-the-wild exploitation was not detected prior to disclosure, NVIDIA urges immediate upgrades to Container Toolkit v1.16.2 and GPU Operator 24.6.2.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: TOCTOU symlink races subvert container namespace isolation during runtime initialization, exposing host control sockets (docker.sock) and enabling immediate root escalation on the host node without triggering kernel-level escape protections.
• Bullet 2 — Strategic & Defender Imperative: Platform engineers and multi-tenant AI infrastructure providers must immediately upgrade to Container Toolkit 1.16.2, restrict unvetted container image execution, and transition GPU orchestration workloads to use the Container Device Interface (CDI).