Skip to main content

NVIDIA GPU Display Driver CVE-2026-24198

| EUVDEUVD-2026-31924 MEDIUM
Information Exposure (CWE-200)
2026-05-26 nvidia GHSA-8gw2-w6v7-3m98
Denial Of Service Information Disclosure Nvidia Geforce Rtx Quadro Nvs Tesla
5.6
CVSS 3.1 · Vendor: nvidia
Share

Severity by source

Vendor (nvidia) PRIMARY
5.6 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
SUSE
MEDIUM
qualitative

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 12:37 vuln.today
CVE Published
May 26, 2026 - 17:17 nvd
MEDIUM 5.6

DescriptionCVE.org

NVIDIA GPU Display Driver for Linux contains a vulnerability where an advanced attacker could use a race condition to leak sensitive memory, which might cause limited exposure of sensitive information to an unauthorized actor. A successful exploit of this vulnerability might lead to denial of service, data tampering, and information disclosure.

AnalysisAI

Race condition in NVIDIA GPU Display Driver for Linux allows a high-privileged local attacker to leak sensitive kernel or process memory, producing limited information disclosure alongside potential data tampering and denial of service. Affected product lines span GeForce, RTX/Quadro/NVS, and Tesla GPU families running Linux driver branches prior to 580.159.03 or 595.71.05. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; an EPSS of 0.01% (1st percentile) and SSVC classification of Exploitation: none together place it at the lowest tier of real-world exploitation priority.

Technical ContextAI

The vulnerability is rooted in a race condition within the NVIDIA GPU Display Driver kernel module for Linux, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Race conditions in kernel drivers arise when two concurrent execution paths access shared memory or driver state without adequate synchronization; a precisely timed attacker operation can observe transient intermediate states containing sensitive data. The affected driver code services three NVIDIA product families confirmed by CPE strings: cpe:2.3:a:nvidia:geforce, cpe:2.3:a:nvidia:rtx,_quadro,_nvs, and cpe:2.3:a:nvidia:tesla, all on Linux. CWE-200 here indicates the core failure is the inadvertent exposure of kernel or cross-process memory contents rather than a traditional write-primitive memory corruption flaw, which constrains the attacker's ability to achieve arbitrary code execution but still enables denial of service and selective data leakage. The SUSE tag in the intelligence feed indicates this has been confirmed or triaged on SUSE Linux distributions specifically.

RemediationAI

Upgrade the NVIDIA GPU Display Driver for Linux to version 580.159.03 or 595.71.05 (or later within the respective branch), as detailed in the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5821. The patch is vendor-confirmed available. Administrators on SUSE-based distributions should check for distribution-provided updated driver packages that bundle the fix rather than installing drivers directly from NVIDIA. If immediate patching is not operationally feasible, restrict access to GPU-equipped Linux systems so that only explicitly trusted, high-privilege service accounts interact with the driver; since exploitation requires local high-privilege access, eliminating untrusted privileged users from affected hosts removes the viable attacker population. Additionally, auditing sudoers and GPU-accessible user groups to enforce least-privilege reduces the attack surface without impacting GPU workloads. Note that GPU driver updates may require a system or service restart, which should be planned as a maintenance window for production GPU workloads.

More in Geforce

View all
CVE-2026-24187 HIGH
8.8 May 26

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
CVE-2026-24193 HIGH
7.8 May 26

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged use
CVE-2026-24192 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
CVE-2026-24191 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a
CVE-2026-24190 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows authenticated low-privilege users to im
CVE-2026-24196 HIGH
7.1 May 26

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24197 MEDIUM
6.5 May 26

NVIDIA Display Driver for Linux exposes a denial-of-service condition in the Multi-Instance GPU (MIG) partition manageme
CVE-2026-24182 MEDIUM
6.5 May 26

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an
CVE-2025-33221 MEDIUM
6.0 May 26

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileg
CVE-2026-24199 MEDIUM
4.7 May 26

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-24198 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy