Skip to main content

NVIDIA Display Driver CVE-2026-24182

| EUVDEUVD-2026-31923 MEDIUM
Improper Locking (CWE-667)
2026-05-26 nvidia GHSA-w2cg-9w9f-whqw
Denial Of Service Nvidia Microsoft
6.5
CVSS 3.1 · Vendor: nvidia
Share

Severity by source

Vendor (nvidia) PRIMARY
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 12:28 vuln.today
CVE Published
May 26, 2026 - 17:16 nvd
MEDIUM 6.5

DescriptionCVE.org

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an attacker with local low-privilege access can leak held driver locks, potentially crashing or hanging the driver stack and denying GPU availability system-wide. Scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the broader kernel or hypervisor layer. No public exploit identified at time of analysis and no CISA KEV listing; EPSS at 0.01% (1st percentile) and SSVC exploitation status of 'none' consistently signal low near-term exploitation likelihood.

Technical ContextAI

CWE-667 (Improper Locking) describes a class of bugs where a lock on a shared resource is acquired but not properly released - or is released in an incorrect order - causing resource exhaustion, deadlocks, or race conditions. In a GPU driver context, the kernel-mode driver manages internal spinlocks or mutexes to serialize access to hardware registers and shared memory structures. If a code path exits without releasing a held lock (e.g., under an error or exceptional condition), subsequent threads or processes attempting to acquire that lock will block indefinitely, leading to a hung driver and denial of service. The Changed Scope (S:C) in the CVSS vector indicates the fault propagates beyond the driver process itself, consistent with a kernel-mode driver crash or hang that can destabilize the host OS or hypervisor. Affected CPE strings span NVIDIA GeForce (cpe:2.3:a:nvidia:geforce), RTX/Quadro/NVS (cpe:2.3:a:nvidia:rtx,_quadro,_nvs), Tesla (cpe:2.3:a:nvidia:tesla), and Guest drivers (cpe:2.3:a:nvidia:guest_driver), covering both bare-metal and virtualized (vGPU) deployments on Windows and Linux.

RemediationAI

The primary remediation is to apply NVIDIA's vendor-released patched drivers. For GeForce Windows, upgrade to 582.53, 595.71.05, or 596.36 depending on the installed branch. For GeForce Linux, upgrade to 580.159.03 or 535.309.01. For RTX/Quadro/NVS Windows, upgrade to 582.53, 539.72, 595.71.05, or 596.36. For RTX/Quadro/NVS Linux, upgrade to 580.159.03 or 535.309.01. For Tesla Windows, upgrade to 539.72 or 596.36. For Tesla Linux, upgrade to 535.309.01, 580.159.03, 582.53, or 595.71.05. For vGPU environments, upgrade the Virtual GPU Manager to the post-March 2026 release version, and update Guest drivers to 535.288.01/539.64, 580.126.09/582.16, or 595.58.03/595.97 depending on the vGPU branch. Full patched driver packages and the official security bulletin are available at https://nvidia.custhelp.com/app/answers/detail/a_id/5821. If immediate patching is not feasible in a multi-tenant environment, consider restricting local shell or GPU process execution to trusted users only, as the attack requires a logged-in low-privilege account; however, this is not a substitute for patching and may limit legitimate user GPU access.

More in Nvidia

View all
CVE-2016-1741 CRITICAL POC
9.8 Mar 24

The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary c
CVE-2013-0109 HIGH POC
7.2 Apr 08

The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not
CVE-2019-5684 CRITICAL POC
10.0 Aug 06

NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
CVE-2026-24207 CRITICAL POC
9.8 May 20

Authentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
CVE-2019-5685 CRITICAL POC
9.8 Aug 06

NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
CVE-2025-23359 HIGH POC
8.3 Feb 12

NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default co
CVE-2016-8812 HIGH POC
8.8 Nov 08

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before G
CVE-2016-1861 HIGH POC
7.8 Jun 19

The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privi
CVE-2024-0132 HIGH POC
8.3 Sep 26

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with de
CVE-2016-1846 HIGH POC
7.8 May 20

The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows a
CVE-2015-7865 HIGH POC
7.7 Nov 24

nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before

CVE-2016-8811 HIGH POC
7.8 Nov 08

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2020-12658 CRITICAL
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-24182 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy