Skip to main content

NVIDIA GPU Driver CVE-2026-24195

| EUVDEUVD-2026-31922 MEDIUM
Improper Input Validation (CWE-20)
2026-05-26 nvidia GHSA-p955-fv2h-g2fx
Denial Of Service Nvidia Guest Driver
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
7.1 HIGH
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Severity Changed
Jun 11, 2026 - 03:07 NVD
HIGH MEDIUM
CVSS changed
Jun 11, 2026 - 03:07 NVD
7.1 (HIGH) 5.5 (MEDIUM)
Analysis Generated
Jun 08, 2026 - 10:23 vuln.today
CVE Published
May 26, 2026 - 17:15 nvd
HIGH 7.1

DescriptionNVD

NVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause improper input validation. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Denial of service in the NVIDIA Display Driver for Linux (UVM kernel module) allows a local user to crash or render the GPU subsystem unavailable through improper input validation. The flaw affects NVIDIA Guest drivers used in vGPU deployments (versions 580.126.09 and 595.58.03 across vGPU 19.4 and 20.0 branches) and carries a CVSS 7.1 with high availability impact and scope change. There is no public exploit identified at time of analysis, and EPSS is very low (0.01%, 2nd percentile), consistent with the local attack vector and DoS-only impact.

Technical ContextAI

The vulnerable component is NVIDIA's Unified Virtual Memory (UVM) kernel driver on Linux, which manages a shared memory address space between CPU and GPU and is required for CUDA Unified Memory workloads. The root cause is classified as CWE-20 (Improper Input Validation), meaning the UVM driver accepts user-supplied data - most likely via an ioctl interface or device-node syscall path - without sufficient sanity checks, allowing a malformed request to drive the kernel module into a faulting state. CPE data identifies the affected product as NVIDIA Guest Driver (cpe:2.3:a:nvidia:guest_driver), the in-VM component of NVIDIA's vGPU virtualization stack, which is the surface exposed when GPUs are partitioned to guest VMs on hypervisors such as KVM, VMware, or Citrix.

RemediationAI

Patch available per vendor advisory: upgrade the NVIDIA Guest Driver to the fixed release listed in NVIDIA security bulletin https://nvidia.custhelp.com/app/answers/detail/a_id/5821 for the appropriate vGPU branch (20.x or 19.x), since exact fixed build numbers are not enumerated in the available intelligence and must be read from the bulletin directly. As an interim mitigation where patching is blocked, restrict access to the /dev/nvidia-uvm and /dev/nvidia-uvm-tools device nodes inside guests to trusted users via filesystem permissions or a Linux LSM policy (AppArmor/SELinux), accepting that this will break CUDA Unified Memory workloads for non-privileged users; alternatively, disable the nvidia-uvm kernel module entirely on guests that do not require CUDA, which will block all UVM-dependent GPU compute. SUSE-packaged drivers (per the SUSE tag) should be updated via the distribution's security channel once the corresponding errata are published.

More in Guest Driver

View all
CVE-2026-24187 HIGH
8.8 May 26

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
CVE-2026-24191 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a
CVE-2026-24196 HIGH
7.1 May 26

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24182 MEDIUM
6.5 May 26

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an
CVE-2025-33221 MEDIUM
6.0 May 26

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileg
CVE-2026-24199 MEDIUM
4.7 May 26

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-24195 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy