NVIDIA GPU Display Driver CVE-2026-24198

Exploitation requires authenticated local access to the Linux host with high privileges (PR:H per CVSS vector) - root-level or equivalent driver-interface permissions are necessary. The attacker must be capable of precisely timing concurrent GPU driver operations to trigger the race window, which the vendor explicitly describes as requiring an 'advanced attacker,' making scripted or automated exploitation unlikely (confirmed by SSVC Automatable: no). The vulnerability is strictly limited to Linux operating systems; Windows NVIDIA drivers are not in scope per available CPE data. There is no indication that a non-default configuration or optional driver feature must be enabled - the vulnerable path appears present in standard driver installations across all three product families. The primary limiting factor is the combination of local-only access and high-privilege requirement, which together rule out remote or unauthenticated exploitation entirely. Exploitation by unprivileged users is not supported by any available data.

The CVSS 3.1 score of 5.6 (Medium) accurately reflects a constrained but non-trivial vulnerability. The vector AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H reveals that while attack complexity is low and no user interaction is needed, the attack is strictly local and demands high privileges - root or equivalent driver-level access. This dramatically limits the exploitable population to already-compromised or insider-threat scenarios. The availability impact rated High (A:H) suggests denial of service is the most achievable practical outcome, while confidentiality and integrity impacts are both Low. All independent risk signals align: EPSS 0.01% (1st percentile) indicates statistically negligible exploitation probability across the wild; SSVC classifies Exploitation as none, Automatable as no, and Technical Impact as partial. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified. The vendor's own description qualifies exploitation as requiring an 'advanced attacker,' further confirming this is not a commodity threat. No conflicting signals are present across CVSS, EPSS, SSVC, and KEV data - this is a genuine low-priority issue for most organizations unless insider threat or privileged-user compromise is a specific concern.

A sophisticated insider or an attacker who has already achieved high-privilege local access on a Linux system running an unpatched NVIDIA GPU driver races two concurrent driver operations to hit a transient memory state, causing the driver to leak kernel or cross-process memory contents. The leaked data could expose credentials, cryptographic material, or other sensitive in-memory information from co-located processes sharing the GPU. No public exploit code exists, making this a targeted rather than opportunistic threat.