Skip to main content

NVIDIA Display Driver CVE-2026-24182

| EUVDEUVD-2026-31923 MEDIUM
Improper Locking (CWE-667)
2026-05-26 nvidia GHSA-w2cg-9w9f-whqw
Denial Of Service Nvidia Microsoft Geforce Rtx Quadro Nvs Tesla Guest Driver Virtual Gpu Manager Nvidia Rtx Quadro Nvs
6.5
CVSS 3.1 · Vendor: nvidia
Share

Severity by source

Vendor (nvidia) PRIMARY
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 12:28 vuln.today
CVE Published
May 26, 2026 - 17:16 nvd
MEDIUM 6.5

DescriptionCVE.org

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an attacker with local low-privilege access can leak held driver locks, potentially crashing or hanging the driver stack and denying GPU availability system-wide. Scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the broader kernel or hypervisor layer. No public exploit identified at time of analysis and no CISA KEV listing; EPSS at 0.01% (1st percentile) and SSVC exploitation status of 'none' consistently signal low near-term exploitation likelihood.

Technical ContextAI

CWE-667 (Improper Locking) describes a class of bugs where a lock on a shared resource is acquired but not properly released - or is released in an incorrect order - causing resource exhaustion, deadlocks, or race conditions. In a GPU driver context, the kernel-mode driver manages internal spinlocks or mutexes to serialize access to hardware registers and shared memory structures. If a code path exits without releasing a held lock (e.g., under an error or exceptional condition), subsequent threads or processes attempting to acquire that lock will block indefinitely, leading to a hung driver and denial of service. The Changed Scope (S:C) in the CVSS vector indicates the fault propagates beyond the driver process itself, consistent with a kernel-mode driver crash or hang that can destabilize the host OS or hypervisor. Affected CPE strings span NVIDIA GeForce (cpe:2.3:a:nvidia:geforce), RTX/Quadro/NVS (cpe:2.3:a:nvidia:rtx,_quadro,_nvs), Tesla (cpe:2.3:a:nvidia:tesla), and Guest drivers (cpe:2.3:a:nvidia:guest_driver), covering both bare-metal and virtualized (vGPU) deployments on Windows and Linux.

RemediationAI

The primary remediation is to apply NVIDIA's vendor-released patched drivers. For GeForce Windows, upgrade to 582.53, 595.71.05, or 596.36 depending on the installed branch. For GeForce Linux, upgrade to 580.159.03 or 535.309.01. For RTX/Quadro/NVS Windows, upgrade to 582.53, 539.72, 595.71.05, or 596.36. For RTX/Quadro/NVS Linux, upgrade to 580.159.03 or 535.309.01. For Tesla Windows, upgrade to 539.72 or 596.36. For Tesla Linux, upgrade to 535.309.01, 580.159.03, 582.53, or 595.71.05. For vGPU environments, upgrade the Virtual GPU Manager to the post-March 2026 release version, and update Guest drivers to 535.288.01/539.64, 580.126.09/582.16, or 595.58.03/595.97 depending on the vGPU branch. Full patched driver packages and the official security bulletin are available at https://nvidia.custhelp.com/app/answers/detail/a_id/5821. If immediate patching is not feasible in a multi-tenant environment, consider restricting local shell or GPU process execution to trusted users only, as the attack requires a logged-in low-privilege account; however, this is not a substitute for patching and may limit legitimate user GPU access.

More in Geforce

View all
CVE-2026-24187 HIGH
8.8 May 26

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
CVE-2026-24193 HIGH
7.8 May 26

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged use
CVE-2026-24192 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
CVE-2026-24191 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a
CVE-2026-24190 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows authenticated low-privilege users to im
CVE-2026-24196 HIGH
7.1 May 26

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24197 MEDIUM
6.5 May 26

NVIDIA Display Driver for Linux exposes a denial-of-service condition in the Multi-Instance GPU (MIG) partition manageme
CVE-2025-33221 MEDIUM
6.0 May 26

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileg
CVE-2026-24198 MEDIUM
5.6 May 26

Race condition in NVIDIA GPU Display Driver for Linux allows a high-privileged local attacker to leak sensitive kernel o
CVE-2026-24199 MEDIUM
4.7 May 26

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-24182 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy