CVE-2026-24193: NVIDIA Display Driver DoS Vulnerability

CVE-2026-24193 Overview

CVE-2026-24193 is an out-of-bounds write vulnerability in the NVIDIA Display Driver for Windows and Linux. The flaw is classified under CWE-787 and allows a local authenticated attacker to write data outside of allocated memory bounds. Successful exploitation can lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution. The vulnerability requires local access and low privileges, but no user interaction is needed to trigger the condition.

Critical Impact

A local attacker with low-privilege access can escalate to higher privileges and execute arbitrary code by triggering an out-of-bounds write in the NVIDIA Display Driver.

Affected Products

• NVIDIA Display Driver for Windows
• NVIDIA Display Driver for Linux
• See the NVIDIA Support Response for specific affected driver branches and versions

Discovery Timeline

• 2026-05-26 - CVE-2026-24193 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-24193

Vulnerability Analysis

The vulnerability stems from an out-of-bounds write condition within the NVIDIA Display Driver. Memory corruption flaws of this class occur when the driver writes data past the end or before the beginning of an allocated buffer. In kernel-mode display drivers, such writes can corrupt adjacent kernel structures, function pointers, or privilege tokens.

An attacker exploiting this flaw locally can corrupt kernel memory to redirect execution flow or escalate privileges from a standard user context to SYSTEM on Windows or root on Linux. The impact spans confidentiality, integrity, and availability, since arbitrary kernel writes enable code execution, data tampering, and system crashes.

The attack requires local access and low-privilege credentials, making this vulnerability relevant in post-compromise scenarios and multi-tenant workstation or virtual desktop environments. No user interaction is required once the attacker has code execution on the target.

Root Cause

The root cause is an CWE-787 out-of-bounds write in the display driver's handling of input data. NVIDIA has not published specific code-level details. Refer to the NVIDIA Support Response for the authoritative technical description.

Attack Vector

The attack vector is local. An attacker first needs the ability to execute code on the target system as an unprivileged user. The attacker then issues crafted requests to the NVIDIA driver interface, typically through IOCTL calls on Windows or ioctl() syscalls against the /dev/nvidia* device nodes on Linux. The malformed input drives the driver into the out-of-bounds write condition.

No verified public proof-of-concept code is available at this time. See the CVE.org Record for CVE-2026-24193 and the vendor advisory for further details.

Detection Methods for CVE-2026-24193

Indicators of Compromise

• Unexpected crashes or bug checks involving NVIDIA driver modules such as nvlddmkm.sys on Windows or nvidia.ko on Linux
• Processes running under unprivileged user accounts spawning child processes with elevated privileges shortly after issuing GPU-related IOCTLs
• Kernel logs showing memory corruption, page faults, or oops messages originating from NVIDIA driver components

Detection Strategies

• Monitor endpoint telemetry for abnormal IOCTL patterns directed at NVIDIA device handles or /dev/nvidia* nodes from non-graphical workloads
• Correlate driver crash events with subsequent privilege changes on the same host to identify exploitation attempts
• Track installed NVIDIA driver versions across the fleet and flag hosts running versions older than the fixed releases identified in the vendor advisory

Monitoring Recommendations

• Enable kernel crash dump collection and forward Windows Event Log and Linux kernel facility entries to a centralized log platform
• Alert on creation of new SYSTEM or root processes by users without administrative entitlements
• Audit GPU driver upgrade compliance on a recurring schedule until all hosts run patched versions

How to Mitigate CVE-2026-24193

Immediate Actions Required

• Apply the patched NVIDIA Display Driver releases listed in the NVIDIA Support Response for both Windows and Linux endpoints
• Inventory all systems running NVIDIA GPUs, including workstations, servers, and virtualized GPU instances, and prioritize multi-user systems for remediation
• Restrict local interactive logon and remote desktop access on high-value hosts until patching is complete

Patch Information

NVIDIA has released updated display driver versions that remediate this vulnerability. Refer to the NVIDIA Support Response for the exact fixed versions across each supported branch and operating system. Validate driver versions after deployment using nvidia-smi on Linux or the NVIDIA Control Panel on Windows.

Workarounds

• No vendor-supplied workaround replaces patching; install the fixed driver as soon as feasible
• Limit local user privileges and remove unnecessary local accounts on shared systems to reduce the population of potential attackers
• On Linux, restrict access to /dev/nvidia* device nodes to required users and groups using filesystem permissions

# Verify NVIDIA driver version on Linux
nvidia-smi --query-gpu=driver_version --format=csv,noheader

# Verify NVIDIA driver version on Windows (PowerShell)
Get-WmiObject Win32_VideoController | Select-Object Name, DriverVersion