NVIDIA Patches Vulnerabilities Causing DoS, EoP, and Data Exposure

NVIDIA today released critical security updates for its BlueField, ConnectX, DOCA, Mellanox DPDK, Cumulus Linux, and NVOS products, addressing multiple vulnerabilities that could allow denial of service, escalation of privileges, and information disclosure.

The vulnerability summary includes CVE-2025-23256 (8.7, High) affecting EoP, DoS, disclosure, and data tampering; CVE-2025-23257 (7.3, High) and CVE-2025-23258 (7.3, High) for EoP; CVE-2025-23259 (6.5, Medium) for disclosure and DoS; CVE-2025-23262 (6.3, Medium) for EoP, DoS, disclosure, and data tampering; and CVE-2025-23261 (5.5, Medium) for information disclosure.

Mitigations urged include updating to the latest firmware and software versions listed, reviewing logs to sanitise exposed passwords, and restricting local access to management interfaces on BlueField and ConnectX devices; further assistance can be obtained through the NVIDIA account manager. To obtain the fixes, visit the NVIDIA Product Security portal, with evaluation-version users advised to contact their account manager for NVOnline access.

The article lists fixed versions for each affected product and emphasises that applying these updates safeguards against service disruption, privilege breaches, and data leaks. According to NVIDIA Product Security portal, customers should act promptly to protect their systems.