CVE-2024-0126: NVIDIA GPU Driver Privilege Escalation Flaw

CVE-2024-0126 Overview

CVE-2024-0126 affects the NVIDIA GPU Display Driver on both Windows and Linux platforms. The flaw stems from improper input validation [CWE-20] in driver components accessible to privileged local users. An attacker with high privileges on an affected system can leverage the weakness to escalate permissions further, execute arbitrary code, disclose sensitive information, tamper with data, or trigger a denial-of-service condition.

NVIDIA published the advisory on its customer support portal and assigned a CVSS 3.1 base score of 8.2. The attack requires local access and no user interaction, and exploitation can cross a security scope boundary.

Critical Impact
Successful exploitation enables local privilege escalation, code execution, data tampering, information disclosure, and denial of service on systems running vulnerable NVIDIA GPU Display Drivers.

Affected Products

NVIDIA GPU Display Driver for Windows
NVIDIA GPU Display Driver for Linux
See the NVIDIA Customer Support Answer 5586 for fixed driver branch and version details

Discovery Timeline

2024-10-26 - CVE-2024-0126 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-0126

Vulnerability Analysis

The vulnerability resides in the NVIDIA GPU Display Driver, a kernel-mode component that handles GPU resource management, command submission, and display services. The driver exposes interfaces to user-mode and kernel-mode callers, and improper validation of caller-supplied input enables a privileged local attacker to misuse those interfaces.

NVIDIA classifies the outcome as a combination of code execution, escalation of privileges, denial of service, information disclosure, and data tampering. The scope change indicates that exploitation affects components beyond the driver's own security context. In practice, that means an attacker who already controls a high-privilege user-mode process can pivot into kernel context or affect other system components that trust the driver.

The weakness is categorized under [CWE-20] Improper Input Validation, which on a kernel driver typically maps to missing bounds checks, missing type checks on IOCTL or ioctl-equivalent parameters, or insufficient sanitization of structures passed across the user-kernel boundary.

Root Cause

The driver accepts input from a caller without sufficient validation. When malformed or out-of-spec parameters reach an internal handler, the driver performs operations on attacker-influenced data inside a higher-privileged context. NVIDIA has not published the exact code path. The advisory at NVIDIA Customer Support Answer 5586 lists the fixed driver versions.

Attack Vector

Exploitation requires local access and existing high privileges. The attacker invokes a vulnerable driver entry point — for example, an IOCTL on Windows or an ioctl on a Linux character device such as /dev/nvidia* — with crafted parameters. No user interaction is needed. Because the scope changes, code that executes inside the driver context can act on resources outside the original privilege boundary.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.064%.

No verified exploit code is publicly available. Refer to the NVIDIA advisory for further technical context.

Detection Methods for CVE-2024-0126

Indicators of Compromise

Unexpected loading or reloading of NVIDIA kernel driver modules such as nvlddmkm.sys on Windows or nvidia.ko on Linux outside scheduled driver updates
New or unsigned processes opening handles to NVIDIA device objects (\\.\NVIDIA* on Windows, /dev/nvidia* or /dev/nvidiactl on Linux) from non-graphics user contexts
Kernel crash dumps or dmesg entries referencing the NVIDIA driver following privileged process activity

Detection Strategies

Inventory installed NVIDIA driver versions across endpoints and servers, then compare against the fixed branches listed in the NVIDIA advisory
Alert on privileged processes that issue unusual IOCTL patterns to NVIDIA device interfaces, particularly outside known graphics, compute, or virtualization workflows
Correlate driver load events with subsequent privilege escalation indicators such as new local administrator accounts or unexpected SYSTEM/root process spawns

Monitoring Recommendations

Forward Windows Sysmon driver-load events (Event ID 6) and Linux auditd records for /dev/nvidia* access into the SIEM for baselining
Track changes to driver version registry keys on Windows (HKLM\SOFTWARE\NVIDIA Corporation\Global) and package state on Linux to identify drift
Monitor for kernel-mode crashes attributed to NVIDIA components, which can indicate failed exploitation attempts

How to Mitigate CVE-2024-0126

Immediate Actions Required

Apply the NVIDIA GPU Display Driver update referenced in NVIDIA Customer Support Answer 5586 on all affected Windows and Linux systems
Prioritize multi-user systems, virtual desktop infrastructure, and shared GPU compute hosts where local privileged access is broader
Restrict local administrator and root membership to reduce the population of accounts that satisfy the high-privilege precondition

Patch Information

NVIDIA released fixed GPU Display Driver versions for Windows and Linux. Consult NVIDIA Customer Support Answer 5586 for the exact driver branches and build numbers that remediate CVE-2024-0126. Deploy through standard enterprise patching channels and reboot to ensure the new kernel driver loads.

Workarounds

No vendor-supplied workaround is documented; applying the updated driver is the supported remediation
Where immediate patching is not possible, limit interactive and remote logon rights on affected hosts to trusted administrators only
On Linux systems that do not require NVIDIA acceleration, unload the kernel module and remove device node access until the patch is applied

bash

# Verify installed NVIDIA driver version
# Windows (PowerShell)
Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*NVIDIA*" } | Select-Object DeviceName, DriverVersion

# Linux
nvidia-smi --query-gpu=driver_version --format=csv,noheader
cat /proc/driver/nvidia/version