TOCTOU container escape in NVIDIA Container Toolkit for Linux

Successful exploitation may allow an attacker controlling a crafted container image to break out of the intended container boundary and interact with the host environment. Reported consequences include host file system access, code execution, denial of service, privilege escalation, information disclosure, and data tampering. The supporting content also indicates the attacker may be able to launch privileged containers through Unix sockets, intercept network traffic, and potentially obtain full system control.

Until patched, reduce exposure by avoiding execution of untrusted or externally supplied container images on hosts using NVIDIA Container Toolkit, especially under default settings. Restrict access to Docker or other container runtime Unix sockets, prevent containers from obtaining unnecessary privileges, and limit host filesystem mounts and other configurations that increase host interaction. Additional hardening should include strict image provenance controls, least-privilege container policies, and segmentation of GPU workloads from sensitive hosts where feasible.

Apply the vendor-provided fix from NVIDIA for CVE-2025-23359 and update NVIDIA Container Toolkit for Linux to a version that addresses the TOCTOU flaw. Because the issue is described as occurring under the default configuration, remediation should include validating that all affected hosts, container runtimes, and dependent GPU-enabled container environments are updated consistently across the fleet.