NVIDIA Display Driver CVE-2026-24182

Exploitation requires an attacker to have local, low-privilege access to the target system (AV:L/PR:L) - a standard unprivileged OS user account is sufficient; no administrative or root privileges are needed to trigger the vulnerability. No user interaction is required (UI:N). The vulnerability is present on both Windows and Linux platforms. For GeForce in certain driver branches, exploitation is further restricted to systems using GPUs based on the Maxwell, Volta, or Pascal GPU architectures - Ampere and later architectures in those branches are not affected. In vGPU environments, Guest driver versions up to specified release thresholds on the hypervisor are also vulnerable, meaning a VM guest tenant with local access inside the VM could potentially trigger the condition. Exploitation is not automatable per SSVC (no), limiting broad or opportunistic attack campaigns. What limits exploitation: the requirement for local OS access rules out remote network-based attacks; the denial-of-service-only impact (C:N/I:N) reduces attacker motivation compared to RCE vulnerabilities; and the architecture restriction in some GeForce branches further narrows the attack surface.

Real-world risk is moderate-to-low despite the CVSS 6.5 score. The attack vector is local (AV:L), requiring the attacker to already have a foothold on the host system with at least low-privilege access (PR:L) - this rules out remote exploitation. The high availability impact (A:H) with changed scope is the primary concern, particularly in shared environments such as vGPU-enabled virtualization hosts where a single tenant disrupting the GPU driver could affect co-located workloads or the hypervisor layer. EPSS at 0.01% (1st percentile) indicates extremely low probability of exploitation in the near term, consistent with SSVC exploitation status of 'none' and automatable 'no.' SSVC technical impact is rated 'partial,' aligning with a denial-of-service-only outcome with no confidentiality or integrity loss (C:N/I:N). No public exploit code exists and the CVE has not been added to CISA KEV. The primary real-world risk scenario is a malicious or compromised local process (e.g., a containerized GPU workload or VM guest) triggering the lock leak to deny GPU availability to other tenants - a meaningful threat in multi-tenant GPU cloud and HPC environments, but low priority for single-user workstations.

A low-privileged user or containerized GPU workload tenant on a shared Linux or Windows system with an NVIDIA GPU executes a crafted sequence of GPU driver IOCTL calls designed to trigger the code path that leaks a held driver lock. Once the lock is leaked and not released, subsequent GPU operations from any user or process block indefinitely on lock acquisition, rendering the GPU driver unresponsive and denying GPU access across the system. In a vGPU-enabled hypervisor environment, this could cause the Virtual GPU Manager to hang, impacting all co-located VM guests sharing the physical GPU. No public exploit code exists at time of analysis.