Robie, I'm first focusing on what I believe is the main point of contention: the removal of the package and the security implications. (c, on your list)
The entity responsible for monitoring these binaries for vulnerabilities is NVIDIA itself. Since the 470 series reached end of life, NVIDIA has continued publishing Display GPU Driver security advisories that apply to newer releases (July 2024, October 2024, January 2025, April 2025, July 2025, October 2025, January 2026, and May 2026). These advisories include vulnerabilities rated High severity, covering issues such as privilege escalation, arbitrary code execution, denial of service, and information disclosure. We cannot determine with certainty which of these vulnerabilities affect the 470 branch because NVIDIA no longer analyzes or publishes security fixes for it. Equally, we cannot assume that vulnerabilities disclosed in supported branches are absent from the 470 branch simply because it is no longer evaluated. We are therefore not in a position to provide meaningful security support for this package. One key question is how Ubuntu policy defines "known severe." The fact that NVIDIA no longer evaluates or discloses vulnerabilities for the 470 branch does not imply that the software is free of severe vulnerabilities. Rather, it means there is no longer an active upstream process identifying or remediating them. Accepting software unless there are known severe vulnerabilities is not covering hazardous scenarios. Therefore, one could argue that there is a meaningful likelihood that one or more vulnerabilities already disclosed in supported NVIDIA driver branches are also present in the 470 branch, even if that cannot be conclusively demonstrated without upstream analysis. This is not something we can do on binary only. About specific answers d) About comment #37 w.r.t 470-server, the destiny of the package should be the same as this one. e) I might not understand your question. The package that was published was a transitional. About HWE I would first recommend assessing the main contention point and then we can move on to HWE policies and how it interacts with vendor provided drivers. Let me know. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2155202 Title: Latest Update Breaks Systems Using Nvidia 470 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/nvidia-graphics-drivers-470/+bug/2155202/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
