Security readout for executives and security teams
Plain-English summary
CVE-2024-58018 is a Linux kernel nouveau GPU driver bug. A bad buffer-space calculation can corrupt internal GPU command data and hang the NVIDIA GSP path. The sources show an availability and stability issue, not evidence of data theft, privilege escalation, or active exploitation.
Executive priority
Treat this as a targeted reliability risk for Linux NVIDIA GPU systems. Prioritize patching where GPU availability affects production workloads, virtualization, AI, rendering, or user-facing services. Broader enterprise urgency is lower unless the affected driver path is present.
Technical view
In nvkm r535_gsp_cmdq_push(), free space in the GSP command queue buffer is calculated incorrectly around queue wraparound. A large RPC request can overwrite an RPC request the GSP is reading, corrupting it and causing a GSP hang.
Likely exposure
Exposure appears limited to Linux systems using the nouveau nvkm driver with the NVIDIA R535 GSP command queue path. Systems not using nouveau, not using affected kernel builds, or not using the relevant NVIDIA GPU/GSP path are unlikely to be exposed based on the bundle.
Exploitation context
The bundle does not show CISA KEV listing, public exploitation, exploit code, or a CVSS score. The described failure occurs during driver/GSP RPC handling and is demonstrated by a kernel warning and GSP hang trace.
Researcher notes
The source bundle identifies the bug and fix commits but does not provide CVSS, CWE, distribution package mappings, or exploitation evidence. Analysis should stay scoped to nouveau nvkm R535 GSP command queue handling and availability impact.
Mitigation direction
- Update to a Linux kernel or distribution package containing the referenced stable fixes.
- Check your Linux vendor advisory for exact fixed package versions.
- Prioritize hosts using nouveau with NVIDIA GPUs or vGPU-related workflows.
- Consider operational workarounds only if your vendor recommends them.
Validation and detection
- Inventory Linux kernel versions on GPU-enabled hosts.
- Identify systems loading nouveau/nvkm with NVIDIA GSP support.
- Review kernel logs for nouveau, nvkm, GSP, or r535_gsp warnings.
- Confirm installed kernels include the referenced stable commits or vendor backports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-58018 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/56e6c7f6d2a6b4e0aae0528c502e56825bb40598CVE reference, Linux
- https://git.kernel.org/stable/c/6b6b75728c86f60c1fc596f0d4542427d0e6065bCVE reference, Linux
- https://git.kernel.org/stable/c/01ed662bdd6fce4f59c1804b334610d710d79fa0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.