GPU Passthrough to a Proxmox VM (2026 Setup Guide)

By LK Wood IV · 2026-05-30 · Updated 2026-10-11 · ~11 min read · St. Louis County, MO

This guide follows Proxmox VE 9.2, released May 21, 2026 with kernel 7.0 as the default, and the 9.2.12 admin guide dated September 18, 2026. Passthrough hands one VM the whole card and lets it run the card’s own driver. The host and every other VM lose the card.

Check whether you need a VM at all. For Jellyfin transcoding or an Ollama box, a container can take the card’s device node while the host keeps the driver; Proxmox added device passthrough for containers in VE 8.1 and put it in the GUI in 8.2; the site’s LXC vs VM guide weighs the two. I would pass a whole card only for a Windows guest, a gaming VM, or a guest that needs its own driver version. A gaming VM will not run VALORANT or League of Legends, because Riot Vanguard refuses virtual machines with VAN 138 and VAN 9100. The transcoding GPU guide and the local LLM guide cover what the card does once it is in.

VirtualBox and VMware use different paths

This procedure is for Proxmox VE’s KVM/VFIO stack. Oracle’s VirtualBox 7.2 user guide says its PCI passthrough feature is currently unavailable and planned to return later. The VBoxManage --pci-attach options remaining in that manual do not make a current VirtualBox GPU-passthrough setup. VirtualBox 3D acceleration is a virtual graphics feature rather than direct assignment of the host GPU. Keep the commands below limited to Proxmox.

“VMware” also needs a product name. Broadcom documents physical PCI assignment as VMDirectPath I/O on VMware vSphere ESXi. Its current procedure enables the PCI device on the ESXi host, then adds a PCI Device to the VM.

Broadcom requires a compatible platform, device and guest driver, plus a full VM memory reservation, and lists lost VM features such as snapshots, suspend/resume, Fault Tolerance and vMotion. That is an ESXi workflow. Desktop VMware Workstation and Fusion require their own documented capability. Follow the VMDirectPath requirements and ESXi configuration procedure instead of reusing Proxmox files or qm commands.

Pre-flight checklist

Clear these before you edit a file. The GPU rows carry the date of the report they rest on, because what a card does at reset has changed with firmware and driver releases.

Step 1: Turn on the IOMMU in firmware

Reboot into the firmware setup. On Intel boards the switch is VT-d; on AMD boards it is IOMMU, sometimes labelled AMD-Vi. KVM itself needs VT-x or SVM, one of the system requirements in the admin guide. Turning CSM off can help too, but only on a host installed in UEFI mode, because a legacy install will not boot without it. If efibootmgr -v in step 2 answers that EFI variables are not supported, the host booted in legacy mode; leave CSM on.

Use the board manual to find the exact firmware option names.

Step 2: Set the kernel command line

The examples from here on use VM 100, PCI address 0a:00 and an RTX 5080’s IDs; put yours in their place, and run host commands in a root shell on the host.

Before changing the host, verify SSH or the web interface from another machine and arrange a recovery console independent of the GPU you will bind. Stop if neither path works.

Before the first edit in steps 2, 3 or 5, make one timestamped backup directory with backup_dir=/root/vfio-backup-$(date +%Y%m%d-%H%M%S); install -d -m 700 "$backup_dir"; printf 'Backup: %s\n' "$backup_dir". Keep the printed path. Save originals before changing any file. For every target file that already exists, run cp -a --parents FILE "$backup_dir" before changing it; for a file that does not exist, record its full path in $backup_dir/created-files.txt. Cover the active bootloader file (/etc/default/grub or /etc/kernel/cmdline), /etc/modules-load.d/vfio.conf, /etc/modprobe.d/vfio.conf, /etc/modprobe.d/blacklist-gpu.conf, and either soft-dependency file you touch. Do not rerun the backup after editing. A later copy would replace the original with the changed file.

If the host fails to return after the reboot, use the recovery console. Run rollback commands as root inside the installed Proxmox system. From rescue media, first mount or import the installed root filesystem and enter a correctly prepared chroot; the paths below must refer to that installed system, not the live rescue image. An initramfs rebuild affects every installed kernel. An older kernel is not a guaranteed escape. Set backup_dir=/root/vfio-backup-YYYYMMDD-HHMMSS to the printed path. Restore each saved file from its matching path under $backup_dir, delete only the files listed in created-files.txt, then run update-initramfs -u -k all. Finish with update-grub on GRUB or proxmox-boot-tool refresh on systemd-boot, and reboot. Restore individual files rather than replacing either configuration directory.

Proxmox VE 9.2 needs no IOMMU flag. The admin guide says IOMMU is on by default for AMD CPUs and, from kernel 6.8, for Intel CPUs as well. The one optional flag is iommu=pt, which the guide says might increase performance. Without it, skip to the dmesg check. Where the flag goes depends on which bootloader the host runs — the installer chose it, not you. The admin guide calls efibootmgr -v the safest check, and proxmox-boot-tool status shows whether the tool keeps the boot partitions in sync.

efibootmgr -v
proxmox-boot-tool status

A host installed on ZFS in UEFI mode boots with systemd-boot unless Secure Boot is on. Everything else uses GRUB. On GRUB, edit GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub and regenerate the config. Add the flag inside the quotes and keep what is already there.

GRUB_CMDLINE_LINUX_DEFAULT="quiet iommu=pt"

update-grub

On systemd-boot the whole command line sits on one line in /etc/kernel/cmdline. Append the flag to what is already there, leaving the root dataset and every other parameter in place, then write it to the boot partitions. The admin guide’s example line, with the flag added, looks like this.

root=ZFS=rpool/ROOT/pve-1 boot=zfs iommu=pt

proxmox-boot-tool refresh

Editing /etc/default/grub on a systemd-boot host changes nothing.

On a running kernel older than 6.8 (uname -r prints it; on Proxmox that means VE 8.1 or earlier on its default kernel), add intel_iommu=on for an Intel CPU. Do not add amd_iommu=on. The kernel’s parameter list has no on value for it.

Reboot, then check.

dmesg | grep -e DMAR -e IOMMU -e AMD-Vi

The guide says to look for IOMMU, Directed I/O or Interrupt Remapping reported as enabled; the exact message varies with hardware and kernel.

Step 3: Load the VFIO modules

Add the three modules to a file under /etc/modules-load.d/; the 9.2 guide names it vfio.conf. If that file already exists, keep its other module lines and add only the missing entries.

# /etc/modules-load.d/vfio.conf
vfio
vfio_iommu_type1
vfio_pci

update-initramfs -u -k all

After the next reboot, lsmod | grep vfio lists all three.

Step 4: Find the card’s IOMMU group and IDs

pvesh get /nodes/{nodename}/hardware/pci --pci-class-blacklist ""

Replace {nodename} with the node’s name from the tree in the web interface before running the command. A group holding the GPU with its own audio function, or with its root port or bridge, is fine. VFIO takes a whole group or nothing. Everything else in the group leaves the host with the card. If that is a USB controller or a NIC the host needs, try the card in another slot; the admin guide says platforms handle their slots differently and another slot can give the separation you need. The Proxmox wiki keeps the ACS override (pcie_acs_override=downstream, built into the Proxmox kernel) as the last option.

Then read the vendor and device IDs of every function on the card.

lspci -nn

An RTX 5080 shows a GPU function and an audio function. 10de:2c02 is the GB203 [GeForce RTX 5080] and 10de:22e9 is its GB203 High Definition Audio Controller. Copy yours from the output. 10de:1aef is the GA102 audio controller found on the RTX 3080, so an ids= line copied from a 30-series example never matches a newer card’s audio function.

Step 5: Bind the card to vfio-pci

Proxmox tries to take a passed-through device away from the host on its own. When that fails, the admin guide gives two fixes: bind the IDs to vfio-pci, and blacklist the host driver. Both act on the whole host. The ids= line takes every device with those IDs, a second card of the same model included, and a blacklisted driver stays unloaded for every device on the host. On a host with no other card on that driver, I would apply both. Each block below goes in the file named on its first line. If the file exists, preserve its unrelated options and blacklist entries instead of replacing the file.

# /etc/modprobe.d/vfio.conf
options vfio-pci ids=10de:2c02,10de:22e9

# /etc/modprobe.d/blacklist-gpu.conf
blacklist nouveau
blacklist nvidia
# for an AMD card instead:
# blacklist amdgpu

If the host driver still wins, load vfio-pci ahead of it with a soft dependency, one per driver.

echo "softdep nouveau pre: vfio-pci" >> /etc/modprobe.d/nouveau.conf
echo "softdep snd_hda_intel pre: vfio-pci" >> /etc/modprobe.d/snd_hda_intel.conf

update-initramfs -u -k all
reboot

Check both functions.

lspci -nnk -d 10de:2c02
lspci -nnk -d 10de:22e9

Each should show Kernel driver in use: vfio-pci. The guide also counts a missing driver line as ready.

Step 6: Create the VM and add the card

For a Windows 11 guest, open Hardware, choose Add, then TPM State, select version 2.0 and place the state volume on the VM’s storage. The Proxmox TPM guide names Windows 11 as requiring a TPM device and supports TPM versions 1.2 and 2.0; Microsoft’s Windows 11 requirements specify TPM 2.0.

In the VM’s Hardware tab, choose Add, then PCI Device, then Raw Device and the card, and tick All Functions and, under Advanced, PCI-Express. ROM-Bar is on by default. Leave Primary GPU off until the guest driver is in. With it on, Proxmox ignores the VM’s virtual display, and noVNC cannot show a passed card’s output, so the console you would install from goes blank.

From the shell, an address with no function suffix (0a:00, not 0a:00.0) passes every function. Use this while installing through the virtual console.

qm set 100 -hostpci0 0a:00,pcie=on

Finish the guest installation and install its GPU driver first. Configure a monitor or remote desktop, shut the VM down, and confirm qm status 100 reports stopped. Only then replace hostpci0 with Primary GPU enabled:

qm set 100 -hostpci0 0a:00,pcie=on,x-vga=on

A card with 24 GB or more on OVMF can outgrow the default 32 GB MMIO window. The wiki’s fix raises it. It overwrites the VM’s args line, so fold in anything already there.

qm set 100 --args '-fw_cfg name=opt/ovmf/X-PciMmio64Mb,string=65536'

Leave the CPU flags alone for a GeForce card on driver R465 or newer. NVIDIA’s R465 note dates from 2021, and a driver new enough for an RTX 5080 is far past it. On an older driver, Proxmox’s documented switch hides KVM from the guest; the line also sets the CPU type to host and replaces any other CPU options.

qm set 100 --cpu host,hidden=1

Step 7: Install the guest and its driver

For Windows 11, install from the noVNC console with Primary GPU off. Add the VirtIO drivers for disk and network, then NVIDIA’s or AMD’s driver from their own site, and plug a monitor into the card or run remote desktop in the guest to see its output, because noVNC never shows it. Once the driver works, tick Primary GPU if the card should be the VM’s only display.

For Linux, an RTX 50 card needs NVIDIA’s open kernel modules. In the Ubuntu guest, add NVIDIA’s repository as its driver installation guide describes, then install the open driver from a root shell in that guest.

apt install nvidia-open

Reboot the guest as NVIDIA’s installation guide directs before running nvidia-smi in step 8.

reboot

Step 8: Check the card from inside the guest

For an NVIDIA card, run this in the guest.

nvidia-smi

It should name the card and its memory. For a real workload, the self-hosted LLM guide sets up Ollama on an NVIDIA card.

Tuning happens inside the guest, where NVIDIA’s driver runs; the host holds the card with vfio-pci and has no NVIDIA driver to tune it with. The settings for this card are in the RTX 5080 undervolt guide.

When it breaks

Black screen when the VM starts

ROM-Bar is on by default. If the card still shows nothing, the wiki’s next step is to dump its ROM and give it to the VM. Stop the VM, then run the dump on the host with your card’s full PCI address, and check that the cd worked before the other lines. The file has to sit under /usr/share/kvm/, because romfile takes a path relative to that directory.

cd /sys/bus/pci/devices/0000:0a:00.0/
echo 1 > rom
cat rom > /usr/share/kvm/gpu.rom
echo 0 > rom

qm set 100 -hostpci0 0a:00,pcie=on,romfile=gpu.rom

That qm set line replaces hostpci0, so add back x-vga=on if the card is the VM’s display. The Proxmox wiki notes that most setups never need the dump.

Error 43 in Windows

Error 43 is a generic Windows driver error. NVIDIA supports GeForce passthrough with current drivers, so hiding the VM is not the fix; check instead that the driver supports the card at all, that the card’s audio function went through with it, that its ROM carries a UEFI image for OVMF and, on an AMD card, that Resizable BAR is off at the host.

The card does not come back after the VM stops

A linux-pci patch for the RTX 5090, posted April 16, 2026, shows the card no longer answering the host’s function-level reset when a VM shuts down: the host logs not ready 65535ms after FLR; giving up, a CPU soft lockup follows, and 5090 owners on Level1Techs describe the host hanging or crashing, with a hard reset as the way out, which takes every other VM down with it. An NVIDIA engineer replied on the list the same day that a known device firmware defect causes it. In 2025, RTX 5070 and 5070 Ti owners on the same forum reported reset failures with Linux guests, and one owner reported it on an RTX PRO 6000 while another passed one through without trouble.

AMD’s RX 6000 and RX 7000 cards have their own reset bug. The Proxmox wiki records it for Navi, and gnif, who wrote vendor-reset, reported on April 24, 2024 that RX 7000 cards do not reset. On September 1, 2026 an RX 9070 XT owner on the Proxmox forum was still working around it with hookscripts. vendor-reset supports Polaris, Vega and Navi 10/12/14 (RX 5000-era) parts only; its table lists the models.

Sources

• Proxmox VE admin guide 9.2.12, PCI(e) Passthrough – IOMMU defaults, iommu=pt, the VFIO modules, the pvesh group check, vfio-pci binding, softdep, q35/OVMF and the x-vga, pcie, rombar and romfile options.
• Proxmox VE admin guide, Trusted Platform Module – Windows 11’s TPM requirement and the supported TPM-state versions.
• Microsoft, Windows 11 system requirements – TPM 2.0 as a minimum requirement.
• Proxmox VE admin guide, Host Bootloader – GRUB or systemd-boot, /etc/kernel/cmdline and proxmox-boot-tool refresh.
• qm.conf(5), Proxmox VE 9.2.12 – hostpci[n] and the hidden CPU option.
• Proxmox VE admin guide, system requirements – Intel VT or AMD-V for KVM, and the web interface on port 8006.
• pve-manager, PCIEdit.js – the PCI Device dialog’s labels (Raw Device, All Functions, Primary GPU, ROM-Bar, PCI-Express under Advanced).
• Proxmox VE 8.2 press release – container device passthrough in the API and CLI since 8.1, in the GUI from 8.2.
• Proxmox wiki, NVIDIA vGPU on Proxmox VE – official support from NVIDIA vGPU Software 18.
• Proxmox wiki, PCI Passthrough – CSM, Resizable BAR, the ROM dump, the ACS override, the OVMF MMIO window and AMD Navi’s reset bug.
• Proxmox VE Roadmap – 9.2’s release date and kernel, container device passthrough in 8.1 and 8.2, NVIDIA vGPU support.
• Linux kernel parameters – the values amd_iommu= and intel_iommu= accept.
• PCI ID database: 10de:2c02, 10de:22e9 and 10de:1aef.
• NVIDIA, GeForce GPU Passthrough for Windows Virtual Machine – R465, one VM, no SR-IOV on GeForce.
• NVIDIA, open-source GPU kernel modules and its driver installation guide for Ubuntu.
• nvidia-smi manual – the command the guest check runs.
• linux-pci, “PCI: Avoid FLR for NVIDIA 5090 GPU” and NVIDIA’s reply, April 16, 2026.
• Level1Techs, RTX 50 series reset reports, March to September 2025, and the state of RX 7000 passthrough, April 24, 2024.
• Proxmox forum, RX 9070 XT reset bug, September 1, 2026.
• vendor-reset – the cards it supports.
• Linux kernel VFIO documentation – the VFIO framework, IOMMU groups and vfio-pci.
• Oracle VirtualBox 7.2 User Guide – the current statement that PCI passthrough is unavailable.
• Broadcom VMDirectPath I/O requirements and ESXi configuration procedure – supported platform/device checks, host and VM configuration, full-memory reservation and unavailable VM features.