Uncontrolled resource consumption in Nouveau
Priority LOW 32CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution. A specially crafted pixel shader can cause remote denial-of-service issues. An attacker can provide a specially crafted website to trigger this vulnerability. This vulnerability can be triggered remotely after the user visits a malformed website. No further user interaction is required. Vulnerable versions include Ubuntu 18.04 LTS (linux 4.15.0-29-generic x86_64), Nouveau Display Driver NV117 (vermagic: 4.15.0-29-generic SMP mod_unload).
Why it matters now
EPSS 0.01429 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nouveau | Nouveau | Ubuntu 18.04 LTS (linux 4.15.0-29-generic x86_64); Nouveau Display Driver NV117 (vermagic: 4.15.0-29-generic SMP mod_unload) | — | No fix listed | CNA |
- Nouveau VendorNouveau Affected Ubuntu 18.04 LTS (linux 4.15.0-29-generic x86_64); Nouveau Display Driver NV117 (vermagic: 4.15.0-29-generic SMP mod_unload) Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:nvidia:geforce_gtx_745_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_745:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_750_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_750_ti_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_750_ti:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_840m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_840m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_845m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:nvidia:geforce_gtx_745_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_745:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_750_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_750_ti_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_750_ti:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_840m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_840m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_845m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:nvidia:geforce_gtx_845m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_850m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_850m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_860m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_860m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_950m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_950m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:geforce_gtx_960m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:geforce_gtx_960m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:quadro_k620_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:quadro_k620:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:quadro_k1200_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:quadro_k1200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:quadro_k2200_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:quadro_k2200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:quadro_m1000m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:quadro_m1000m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:quadro_m1200m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:quadro_m1200m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:grid_m30_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:grid_m30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
| cpe:2.3:o:nvidia:grid_m40_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NVIDIA |
| cpe:2.3:h:nvidia:grid_m40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NVIDIA |
- cpe:2.3:h:nvidia:geforce_gtx_845m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_850m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_850m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_860m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_860m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_950m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_950m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:geforce_gtx_960m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:geforce_gtx_960m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:quadro_k620_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:quadro_k620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:quadro_k1200_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:quadro_k1200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:quadro_k2200_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:quadro_k2200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:quadro_m1000m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:quadro_m1000m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:quadro_m1200m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:quadro_m1200m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:grid_m30_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:grid_m30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
- cpe:2.3:o:nvidia:grid_m40_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NVIDIA
- cpe:2.3:h:nvidia:grid_m40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NVIDIA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-3979
- 2026-10-03 Alias added: GHSA-m48r-fqqr-r9gc
References
Sources
- CVE-2018-3979 · CVE Program
- CVE-2018-3979 · NVD
- FIRST EPSS
- GHSA-m48r-fqqr-r9gc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences