Preface: About 26 years ago, mainframe computers—especially the IBM S/390—installed FICON switches with optical fiber connections to interconnect with host nodes. As time went by, the design of supercomputers relied more heavily on Linux-based HPC (High-Performance Computing) clusters. Nvidia’s CUDA tools empowered traditional 64-bit instruction sets (which favor sequential processing) to extend into GPU multiprocessing operations. Despite these shifts, modern architecture still heavily retains a reliance on high-speed network switches.
Background: NVIDIA Cumulus Linux is an open network operating system designed exclusively to run on bare-metal data center network switches (routing and switching gear), not on compute nodes with GPUs.
Remark: Because data transfer must happen at ultra-high speeds, active data packets do not pass through Linux daemons. Passing data through a daemon would require context switching to user space, which ruins network performance.
On the Network Switch (Running NVIDIA Cumulus Linux)
• switchd (The Core Daemon): This is the most critical daemon on Cumulus Linux. It acts as the bridge between the Linux kernel and the physical switch ASIC. When the switch boots or routing changes, switchd programs the hardware ASIC so that your CUDA traffic can be forwarded instantly at the hardware level without taxing the switch’s CPU.
• frr (FRRouting Daemon): This daemon manages dynamic routing protocols (like BGP or OSPF) in the data center. It ensures the switch knows the fastest network path between your CUDA servers.
In Cumulus Linux 5.x, account and device management is primarily conducted through the NVUE (NVIDIA User Experience) interface. NVUE provides a REST API, CLI command line, and API-based management tools (object-based management interface).
Vulnerability details:
CVE-2026-24183 NVIDIA Cumulus Linux contains a vulnerability where an unprivileged user could use improper privilege management on the system. A successful exploit of this vulnerability might lead to escalation of privileges.
CVE-2026-24184 NVIDIA Cumulus Linux contains a vulnerability where an unauthenticated attacker could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.
Remark: The latest security bulletin released in August 2026, CVE-2026-24183 (and the earlier CVE-2025-33179), pointed out a serious permission control flaw in the User Management Component of NVIDIA Cumulus Linux. This can indeed allow unprivileged users to bypass restrictions and obtain root privileges on the local machine.
Please refer to the link for details – http://www.antihackingonline.com/potential-risk-of-cve/cve-2025-33179-and-cve-2025-33180-about-nvidia-cumulus-linux-and-nvos-products-25-02-2026/
Official announcement: Please refer to the link for details –