Nvidia patched 114 GPU driver flaws on September 30, and one is rated 9.9 - MIXED Reality News

A single patch cycle fixing 114 driver flaws isn't an engineering misstep—it's a structural exposure. The 9.9 CVSS score points to kernel-level remote code execution, which for clusters running tens of thousands of accelerators isn't a patch problem; it's a recalibration of the entire CUDA trust chain. The blast radius extends far beyond silicon: CUDA runtime, NCCL communication libraries, and container isolation layers all share the same trust domain. The 2019 Qualcomm baseband vulnerability that touched billions of devices is the template—when drivers are deeply coupled to hardware, the attack surface scales exponentially with compute density. On compliance, an unpatched critical flaw inside a SOC 2 audit window triggers immediate supply-chain re-review from enterprise clients. For OEMs shipping NVIDIA DRIVE, a single driver-level RCE under ISO 26262 ASIL-D requirements can cascade into a batch recall. Competitively, AMD and Intel won't stop at PR. The deeper signal: AI compute buyers are accelerating dual-vendor strategies, and driver security will become an explicit scoring penalty in 2025–2026 procurement RFPs. Over the next 18 months, expect three shifts: GPU driver sandboxing (an SELinux-like model) becoming standard in data centers; regulators classifying GPU drivers as critical-infrastructure software; and the emergence of an independent third-party driver-audit market from zero to one.