For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver on Linux R304 before 304.132, R340 before 340.98, R367 b…

published 2016-11-08 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-8245

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver on Linux R304 before 304.132, R340 before 340.98, R367 before 367.55, R361_93 before 361.93.03, and R370 before 370.28 contains a vulnerability in the kernel mode layer (nvidia.ko) handler for mmap() where improper input validation may allow users to gain access to arbitrary physical memory, leading to an escalation of privileges.

Patch / fix

distros 2 links 1

debian ubuntu

nvidia-graphics-drivers Debian 14, Debian 13, Debian 12 367.57-1

debian advisories DEBIAN-CVE-2016-7389

nvidia-graphics-drivers-304 Ubuntu 14.04 LTS 304.132-0ubuntu0.14.04.2
nvidia-graphics-drivers-304 Ubuntu 16.04 LTS 304.132-0ubuntu0.16.04.2
nvidia-graphics-drivers-340 Ubuntu 14.04 LTS 340.98-0ubuntu0.14.04.1
nvidia-graphics-drivers-340 Ubuntu 16.04 LTS 340.98-0ubuntu0.16.04.1

ubuntu advisories UBUNTU-CVE-2016-7389

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

nvidia.custhelp.com/app/answers/detail/a_id/4246 advisory

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

n/a Quadro, NVS, GeForce, and Tesla (all versions)

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

nvidia.custhelp.com /app/answers/detail/a_id/4246
patch, vendor-advisory
securityfocus.com /bid/94177
vdb-entry

Sources

CVE List CVE-2016-7389
NVD CVE-2016-7389

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary