CVE-2026-24196: NVIDIA Linux Driver DoS Vulnerability

CVE-2026-24196 Overview

CVE-2026-24196 is an out-of-bounds read vulnerability in the NVIDIA Display Driver for Linux. A local authenticated user can trigger the flaw to read memory outside the intended buffer boundaries. Successful exploitation can lead to denial of service and information disclosure on affected systems.

The vulnerability is classified under [CWE-125] (Out-of-bounds Read) and carries a CVSS 3.1 base score of 7.1. The attack requires local access with low privileges and no user interaction. NVIDIA has published guidance in NVIDIA Support Answer #5821.

Critical Impact
A local user with low privileges can read out-of-bounds memory in the NVIDIA Linux Display Driver, exposing sensitive kernel or driver memory contents and potentially crashing the system.

Affected Products

NVIDIA Display Driver for Linux
Systems running NVIDIA GPU drivers on Linux distributions
Refer to NVIDIA Support Answer #5821 for specific affected driver branches and versions

Discovery Timeline

2026-05-26 - CVE-2026-24196 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-24196

Vulnerability Analysis

The vulnerability resides in the NVIDIA Display Driver for Linux, which runs with elevated privileges as a kernel-mode component. An out-of-bounds read condition allows a local attacker to access memory locations beyond the allocated buffer.

This class of flaw [CWE-125] typically arises when the driver processes user-supplied input without correctly validating size, length, or offset values before dereferencing a pointer. When the read crosses buffer boundaries, the driver may return adjacent kernel memory contents to the user-space caller or trigger a fault that halts the system.

The impact subscores indicate high confidentiality and high availability impact, with no integrity impact. This pattern is consistent with leakage of kernel memory and the ability to crash the driver or the host kernel.

Root Cause

The root cause is missing or insufficient bounds checking inside the NVIDIA Linux Display Driver when handling input from a local, low-privileged user. The driver dereferences memory using attacker-influenced size or index values without verifying they remain within allocated buffer limits.

Attack Vector

The attack vector is local. An attacker must already have low-privileged code execution on the target host, typically through a standard user account or a compromised service. The attacker then issues crafted requests to the NVIDIA driver interface — such as ioctl calls against the NVIDIA device nodes — to trigger the out-of-bounds read.

No user interaction is required, and the scope remains unchanged. Network-based exploitation is not possible because the driver interface is not exposed remotely.

The NVIDIA security bulletin in NVIDIA Support Answer #5821 documents the affected driver branches and the technical advisory details.

Detection Methods for CVE-2026-24196

Indicators of Compromise

Unexpected crashes or kernel oops messages referencing nvidia.ko or related NVIDIA kernel modules in /var/log/kern.log or dmesg
Repeated ioctl calls from non-graphics processes to /dev/nvidia* device nodes by low-privileged users
Unusual segmentation faults in user-space processes that interact with the NVIDIA driver shortly before crashes

Detection Strategies

Monitor kernel ring buffer output for fault traces involving NVIDIA driver symbols and correlate with the invoking process and user identity
Audit ioctl system calls targeting NVIDIA device files using auditd rules on /dev/nvidia0, /dev/nvidiactl, and /dev/nvidia-uvm
Compare installed NVIDIA driver versions against the fixed releases listed in the NVIDIA security bulletin and flag hosts running vulnerable builds

Monitoring Recommendations

Forward kernel logs and auditd events to a central SIEM and create alerts for repeated NVIDIA driver faults from the same local user
Track process execution chains that load NVIDIA libraries from non-graphics workloads to identify reconnaissance against the driver
Maintain a driver version inventory across all Linux GPU hosts and review it after each NVIDIA security bulletin

How to Mitigate CVE-2026-24196

Immediate Actions Required

Apply the patched NVIDIA Display Driver for Linux release identified in NVIDIA Support Answer #5821 on all affected hosts
Limit local interactive and shell access on systems running the NVIDIA driver, especially multi-tenant workstations and shared compute nodes
Review which user accounts and services require access to NVIDIA device nodes and remove unnecessary access

Patch Information

NVIDIA has released updated Linux Display Driver versions that remediate the out-of-bounds read. Consult NVIDIA Support Answer #5821 for the fixed driver branches and download links. After installation, reload the kernel module or reboot the host so that the patched driver is active.

Administrators should also review the NIST CVE-2026-24196 Details and the CVE.org Record for CVE-2026-24196 for additional references.

Workarounds

Restrict permissions on /dev/nvidia* device files so that only required users and groups can issue ioctl calls
Disable or unload the NVIDIA driver on hosts that do not require GPU acceleration until the patched driver is deployed
Apply mandatory access control profiles such as SELinux or AppArmor to confine processes that interact with the NVIDIA driver

bash

# Configuration example: verify installed NVIDIA driver version and tighten device permissions
nvidia-smi --query-gpu=driver_version --format=csv,noheader
ls -l /dev/nvidia*
chgrp video /dev/nvidia*
chmod 0660 /dev/nvidia*