Skip to main content

NVIDIA Display Driver CVE-2026-24190

| EUVDEUVD-2026-31930 HIGH
Missing Authorization (CWE-862)
2026-05-26 nvidia GHSA-95fc-m9jj-88x5
Nvidia RCE Linux Information Disclosure Microsoft Denial Of Service Authentication Bypass Geforce Rtx Quadro Nvs Tesla
7.8
CVSS 3.1 · Vendor: nvidia
Share

Severity by source

Vendor (nvidia) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 10:07 vuln.today
CVE Published
May 26, 2026 - 17:22 nvd
HIGH 7.8

DescriptionCVE.org

NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause improper access to GPU resources. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

AnalysisAI

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows authenticated low-privilege users to improperly access GPU resources via a kernel mode layer flaw, potentially leading to code execution, privilege escalation, information disclosure, data tampering, and denial of service. The issue affects GeForce, RTX/Quadro/NVS, and Tesla product lines across multiple driver branches and carries a CVSS 7.8 (High) score. No public exploit identified at time of analysis, and EPSS probability is very low (0.01%), but the breadth of affected hardware and total technical impact warrant prompt patching.

Technical ContextAI

The vulnerability resides in the kernel-mode component of NVIDIA's GPU display driver - the privileged Windows nvlddmkm.sys / Linux nvidia.ko module responsible for mediating user-space requests to GPU hardware. The CWE-862 (Missing Authorization) classification indicates the kernel driver fails to properly validate whether a calling user context is permitted to perform a given operation on GPU resources (likely via IOCTL or device-node interactions), allowing an unprivileged local user to reach code paths or memory regions that should require higher privileges. CPE data confirms the flaw spans NVIDIA's consumer (GeForce), professional workstation (RTX, Quadro, NVS), and datacenter (Tesla) product families across both Windows and Linux driver builds, with the GeForce line specifically limited to Maxwell, Volta, and Pascal architectures per the vendor advisory.

RemediationAI

Apply the vendor-released patched drivers from NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5821: upgrade Windows GeForce/RTX/Quadro/NVS/Tesla drivers to 596.36 or later (or to 582.53 / 539.72 if pinned to an older supported branch), and Linux drivers to 595.71.05, 580.159.03, or 535.309.01 depending on the production branch in use. Because the flaw requires local low-privileged access, interim compensating controls include restricting interactive and remote-desktop logon to trusted accounts, enforcing application allow-listing to prevent unprivileged users from running untrusted binaries that could call the vulnerable IOCTLs, and on multi-tenant or VDI/GPU-passthrough hosts prioritizing the update because any tenant becomes a candidate attacker - note that disabling the GPU driver entirely is not a realistic mitigation on workstations and would break display and CUDA workloads.

More in Geforce

View all
CVE-2026-24187 HIGH
8.8 May 26

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
CVE-2026-24193 HIGH
7.8 May 26

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged use
CVE-2026-24192 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
CVE-2026-24191 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a
CVE-2026-24196 HIGH
7.1 May 26

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24197 MEDIUM
6.5 May 26

NVIDIA Display Driver for Linux exposes a denial-of-service condition in the Multi-Instance GPU (MIG) partition manageme
CVE-2026-24182 MEDIUM
6.5 May 26

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an
CVE-2025-33221 MEDIUM
6.0 May 26

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileg
CVE-2026-24198 MEDIUM
5.6 May 26

Race condition in NVIDIA GPU Display Driver for Linux allows a high-privileged local attacker to leak sensitive kernel o
CVE-2026-24199 MEDIUM
4.7 May 26

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-24190 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy