[SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

tux_99 · 2026-10-12 19:35:06

As you might know already, two weeks ago Nvidia announced a long list of high-severity CVEs that affect all but their latest drivers.
See here: https://nvidia.custhelp.com/app/answers … /a_id/5861

The minimum driver version that has fixes for those CVEs is 580.178.04

Debian is stuck on 550.163.01 even for unstable, there is no sign of the 580 branch drivers (or any even newer branch), not even in experimental: https://tracker.debian.org/pkg/nvidia-graphics-drivers

To be fair Debian doesn't officially support the Nvidia drivers as they are in the non-free repo so if they want they can just ignore this (although it looks very bad having such important drivers with so many CVEs in an official repo).

Nvidia themselves provide an official repo with driver packages for Debian 13, but the oldest driver branch in this repo is 590 which only works for newer cards (GTX 16xx onwards): https://developer.download.nvidia.com/c … 13/x86_64/
Switching to this repo could be a good solution for anyone with newer cards (GTX 16xx onwards).

I have a GTX 1050 so I need the 580.xx driver branch.

Nvidia has the 580.178.04 driver (the version with all CVEs fixed) both in their Ubuntu 24.04 and in their Debian 12 repos:
https://developer.download.nvidia.com/c … 12/x86_64/
https://developer.download.nvidia.com/c … 04/x86_64/

I read that some people installed the 580.xx drivers from the Debian 12 repo on Debian 13 and apparently it worked for them.

OTOH Ubuntu 2404 seems to be more version-aligned with Debian 13 / Devuan 6 than Debian 12.
Do you think that on Devuan 6 it might be a better idea to try the 580.xx drivers for Ubuntu 2404 or the ones for Debian 12?

Or should I continue to wait and hope that the Debian Nvidia driver maintainers eventually catch up and make the patched 580.178.04 driver available in Debian 13 backports?
Is there any chance that this will happen within the next few weeks?

What are other Devuan 6 + Nvidia users here planning to do?

Last edited by tux_99 (2026-10-12 19:53:20)

tux_99 · 2026-10-12 21:09:43

After further investigation I found that apparently even the 580.xx drivers in the official Nvidia repo only include the open source kernel drivers and therefore are not suitable for cards older than the GTX 16xx.

The proprietary kernel modules have been removed. The open kernel modules are now the only kernel module flavor provided.

https://docs.nvidia.com/datacenter/tesl … dates.html

Therefore for cards older than the GTX 16xx series (that require the proprietary kernel modules) the only options are either use the generic unpackaged Linux driver from the Nvidia driver download page ( https://www.nvidia.com/en-us/drivers/ ) with all the mess that causes on the filesystem, or wait and hope that the Debian maintainers make the drivers available as deb package in backports.

Or does anyone here have a better idea?

Last edited by tux_99 (2026-10-12 21:10:44)

blackhole · 2026-10-13 08:17:16

90 vulnerabilities listed...

Unfortunately, the old advice still stands. As Debian "freeze" the stable release, the Nvidia proprietary driver will most likely remain at that version. So the usual course of action is to install from the Nvidia shellscript (and reinstall from that after every kernel update). As it's a proprietary driver, no backporting of any security fixes is possible.

I have always taken the view that Debian simply should not have packaged these from day one, as this is old ground we have been going over for the last 20+ years.

The Debian wiki article discourages Nvidia hardware and also highlights the "planned obsolescence" aspects - but this is also relevant to AMD and Intel, which it appears to endorse.

rolfie · 2026-10-13 10:34:39

I have seen somebody claim that MX Linux supports older NVidia graphics. They are said to patch the drivers and adapt them to newer kernels.

I have no personal experience with MX.

I stay away from that special graphics company since I started with Linux more than 20 years ago.

SS · 2026-10-13 16:37:37

Hi
I did a bit of reading as I have a 4k screen on my laptop with the same card, but no idea if this would work. I haven't got round to trying to set up the Nvidia card on it at all.

1. The Cuda drivers are proprietary not open source.
2. The Nvidia guide talks of creating a preferences.d file to ensure pinning is applied to ensure only the 580 version is used when later updates are run https://docs.nvidia.com/datacenter/tesl … cking.html
3. The log file here explains why the pinning method is advised by Nvidia https://forums.developer.nvidia.com/t/d … nts/353805
4. The NVDC section of the Debian wiki advises to use the pinning method with caveats. https://wiki.debian.org/NvidiaGraphicsD … 2_.26_D-13

This might or might not help. I am new to Devuan and not a developer, but sharing incase of use

Last edited by SS (2026-10-13 16:39:47)

SS · 2026-10-13 22:32:18

Hi
Another thought following your point re the mess using the Nvidia run files causes. That is use of containerisation.

Reading this post, developers are using that concept by putting the driver in the opt folder https://forums.developer.nvidia.com/t/c … /124836/15

However they are having to use the the utility prefix, open gl prefix and 32 bit compatibility libraries to avoid messing up the usr bin folders and the usr libraries. The prefixes used and what they do is in the Nvidia installer code options section https://github.com/NVIDIA/nvidia-instal … on_table.h

We can see in this post that a user called wild tux https://forums.developer.nvidia.com/t/l … tall/46411 had to set x prefix back to usr.
These links help infer the risk of having X11 items sandboxed and hence why the defaults for these are not to sandbox to avoid a display server crash

This is far as I have got. I then started getting a bit lost. It would need someone with more experience to advise if this kind of approach has any legs

Last edited by SS (2026-10-13 22:33:38)

SS · Today 11:15:40

I'm not getting my hopes up. This shows the issue has been raised formerly on the Nvidia side for months https://github.com/NVIDIA/cuda-repo-man … er-sign-up

tux_99 · Today 13:23:25

I have solved it by installing the 580.178.04 drivers from the official Nvidia repo for Debian 12 following these instructions from the Debian Wiki:
https://wiki.debian.org/NvidiaGraphicsD … dc-maxwell

The only other thing not mentioned in those instructions that I had to do is append nomodeset=1 in /etc/default/grub to the GRUB_CMDLINE_LINUX line and then obviously run update-grub as root.

My concerns that the 580.xx drivers from the official Nvidia repo no longer included the proprietary kernel modules (as stated in the Nvidia docs I linked to in post #2) were unfounded, that statement must refer to the newer driver branches that only support cards from the GTX 16xx and newer, which don't require the proprietary kernel modules anyway.

Of course using drivers built for Debian 12 on Debian 13 / Devuan 6 is not the cleanest solution but everything seems to work fine so it's a usable solution.

It's still better than installing the generic Nvidia Linux drivers that don't come as package and therefore cause a mess of unmanaged files on the filesystem.

Still, it would be great if the Debian packagers responsible for packaging the Nvidia drivers would wake up from their slumber and make a proper Debian 13 package of the 580.178.04 driver, having outdated and highly vulnerable packages (90 high-risk CVEs!!) in the Debian repos simply looks very bad for Debian.

Last edited by tux_99 (Today 14:05:05)

tux_99 · Today 13:32:23

rolfie wrote:

I stay away from that special graphics company since I started with Linux more than 20 years ago.

I have been using mostly Nvidia for the past 18 years as both their hardware and their drivers (and software ecosystem around it) are superior to anything GPU related from AMD and Intel.

Of course if you only use generic desktop apps (browsing, office apps) that doesn't matter much, but if you need good video decoding/encoding, cuda and other such things then Nvidia was and still is the best choice.

TBH I never had issues with Nvidia drivers with other (not Debian based) Linux distros in the past, the packagers of others distros (at least of those I used) were more proactive and made sure that they had up-to-date and fully usable Nvidia drivers available in their repos.

Last edited by tux_99 (Today 13:55:24)

SS · Today 17:00:29

Hi, brilliant and thank you for sharing

Question , the part around "Since 2026-02-01, Debian-13 rejects signatures using SHA1 used in the NV D-12 repo. Additionally, D-13 migrated signature verification tool from gpgv to sqv that does not accept additional options from apt sources. To workaround it all, you need to......"

Does that compromise security in any material way for a home laptop user, and did you have to follow this part of the guide?

Appreciate your advice. Cheers

Last edited by SS (Today 17:17:08)

kapqa · Today 17:45:32

in my view to company is over-evaluated;

i like ATI and consider them the superior designs (but am not real knowledgeeable in the technical side of things), but have to agree that nvidia has some excellent "benchmarks" and they seem to command the market for some time now; lets see how long that will last.

for linux users, overall, i still prefer the AMD cards, hands down.
(might be biased since i tend to buy "small").

The officially official Devuan Forum!

#1 2026-10-12 19:35:06

[SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#2 2026-10-12 21:09:43

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#3 2026-10-13 08:17:16

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#4 2026-10-13 10:34:39

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#5 2026-10-13 16:37:37

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#6 2026-10-13 22:32:18

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#7 Today 11:15:40

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#8 Today 13:23:25

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#9 Today 13:32:23

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#10 Today 17:00:29

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

#11 Today 17:45:32

Re: [SOLVED] Nvidia drivers with security issues - what solutions for Devuan 6?

Board footer