Skip to main content

NVIDIA Display Driver CVE-2026-24197

| EUVDEUVD-2026-31926 MEDIUM
Initialization of a Resource with an Insecure Default (CWE-1188)
2026-05-26 nvidia GHSA-fmw6-8h3h-292c
Denial Of Service Nvidia Geforce Rtx Quadro Nvs Tesla Virtual Gpu Manager
6.5
CVSS 3.1 · Vendor: nvidia
Share

Severity by source

Vendor (nvidia) PRIMARY
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 12:37 vuln.today
CVE Published
May 26, 2026 - 17:19 nvd
MEDIUM 6.5

DescriptionCVE.org

NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memory subsystem routing resources could lead to data corruption or a hang during partition reconfiguration. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

NVIDIA Display Driver for Linux exposes a denial-of-service condition in the Multi-Instance GPU (MIG) partition management subsystem, rooted in insecure default initialization of memory subsystem routing resources (CWE-1188). A local authenticated user - with low privileges on a Linux system running MIG-enabled Tesla, GeForce, RTX/Quadro/NVS, or Virtual GPU Manager driver branches - can trigger a hang or data corruption during partition reconfiguration, potentially disrupting all GPU workloads sharing the affected physical GPU. No public exploit code exists and this vulnerability is not in CISA KEV; EPSS sits at 0.01% (2nd percentile), indicating no observed mass exploitation at time of analysis.

Technical ContextAI

Multi-Instance GPU (MIG) is an NVIDIA feature, introduced with Ampere-class hardware, that partitions a single physical GPU into multiple isolated compute instances, each with dedicated memory and compute slices. CWE-1188 (Insecure Default Initialization of Resource) applies here: memory subsystem routing resources - internal structures that direct traffic between MIG partition compute engines and memory controllers - are not safely initialized prior to use during a reconfiguration event. When a partition is reconfigured, uninitialized state in these routing resources can produce undefined behavior: either a system hang (the GPU or driver enters a non-responsive state) or data corruption within the GPU memory fabric. The CVSS scope being 'Changed' (S:C) reflects that the impact can propagate beyond the MIG instance being reconfigured, affecting co-resident GPU instances on the same physical device. Affected CPE entries cover cpe:2.3:a:nvidia:geforce, cpe:2.3:a:nvidia:rtx,_quadro,_nvs, cpe:2.3:a:nvidia:tesla, and cpe:2.3:a:nvidia:virtual_gpu_manager across multiple driver branches.

RemediationAI

Apply the NVIDIA-released patched drivers available via the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5821. For the 535.x branch, update to driver version 535.309.01 or later. For the 580.x branch, update to 580.159.03 or later. For the 595.x branch, update to 595.71.05 or later. For Virtual GPU Manager deployments on the vGPU 19.x track (host drivers 580.126.08 or 582.16), upgrade to a version beyond the vGPU 19.4 boundary; for the vGPU 20.x track (host drivers 595.58.02 or 595.94), upgrade to a version beyond vGPU 20.0. If immediate patching is not possible, a targeted compensating control is to disable MIG mode on affected GPUs (nvidia-smi mig -i <GPU_ID> -dci followed by nvidia-smi -i <GPU_ID> --multi-instance-gpu 0), which eliminates the vulnerable code path entirely but removes GPU partitioning capability, forcing workloads onto whole-GPU scheduling. This is only viable in environments where MIG-based multi-tenancy is not operationally required.

More in Geforce

View all
CVE-2026-24187 HIGH
8.8 May 26

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
CVE-2026-24193 HIGH
7.8 May 26

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged use
CVE-2026-24192 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
CVE-2026-24191 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a
CVE-2026-24190 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows authenticated low-privilege users to im
CVE-2026-24196 HIGH
7.1 May 26

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24182 MEDIUM
6.5 May 26

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an
CVE-2025-33221 MEDIUM
6.0 May 26

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileg
CVE-2026-24198 MEDIUM
5.6 May 26

Race condition in NVIDIA GPU Display Driver for Linux allows a high-privileged local attacker to leak sensitive kernel o
CVE-2026-24199 MEDIUM
4.7 May 26

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2026-66066 CRITICAL POC
9.5
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8
CVE-2025-70998 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-24197 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy