CVE-2026-24198: NVIDIA GPU Driver Race Condition Flaw

CVE-2026-24198 Overview

CVE-2026-24198 is a race condition vulnerability in the NVIDIA GPU Display Driver for Linux. An advanced local attacker with high privileges can exploit the timing flaw to leak sensitive memory contents from the driver. NVIDIA states that successful exploitation may lead to denial of service, data tampering, and information disclosure.

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The flaw requires local access and high privileges, which limits the scope of likely exploitation but does not eliminate risk in multi-tenant or shared GPU environments.

Critical Impact

A local attacker with high privileges can race the NVIDIA Linux GPU driver to leak sensitive kernel memory, tamper with data, or trigger denial of service on affected systems.

Affected Products

• NVIDIA GPU Display Driver for Linux
• Specific affected driver branches and versions are listed in the NVIDIA Security Bulletin (Answer ID 5821)
• Systems running NVIDIA GPU workloads on Linux hosts, including workstations and shared compute nodes

Discovery Timeline

• 2026-05-26 - CVE-2026-24198 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-24198

Vulnerability Analysis

The vulnerability is a race condition in the NVIDIA GPU Display Driver for Linux. Race conditions occur when the security of an operation depends on the timing or ordering of concurrent events. An attacker who wins the race can observe driver state during an inconsistent window and read memory that should remain isolated.

NVIDIA describes the impact as limited exposure of sensitive information. However, the advisory also notes potential denial of service and data tampering, which suggests the racing code path touches state used by other driver operations. Exploitation requires local access to the host and elevated privileges on the system.

The attack vector is local with low complexity, and exploitation does not require user interaction. The confidentiality and integrity impact are scoped as low, while availability impact is high. The EPSS data indicates a very low predicted exploitation probability at this time.

Root Cause

The root cause is improper synchronization between concurrent operations inside the GPU driver. When two threads or contexts access shared driver state without correct locking, an attacker can interleave operations to read memory that the driver intended to protect. This category of flaw aligns with [CWE-200] information exposure resulting from a timing window.

Attack Vector

An attacker first needs local execution on the host with high privileges, such as a user that can issue ioctl calls to the NVIDIA kernel driver. The attacker then issues concurrent requests designed to interleave with a privileged driver operation. By repeatedly racing the targeted code path, the attacker can capture memory contents disclosed during the inconsistent window.

No public proof-of-concept exploit is currently available. Refer to the NVIDIA Security Bulletin (Answer ID 5821) for vendor-specific technical guidance.

Detection Methods for CVE-2026-24198

Indicators of Compromise

• Unexpected high-frequency ioctl calls to NVIDIA driver device nodes such as /dev/nvidia* from non-graphics workloads
• Local processes spawning many concurrent threads that repeatedly invoke the same GPU driver entry point
• Kernel log entries from the nvidia module indicating unusual error states, faults, or warnings

Detection Strategies

• Monitor process behavior on Linux hosts running NVIDIA drivers for tight loops issuing GPU ioctls from unprivileged or unexpected service accounts
• Correlate kernel ring buffer messages with process telemetry to identify driver instability that coincides with suspicious local activity
• Use Linux audit rules to record access to /dev/nvidia* devices by processes outside an approved allowlist

Monitoring Recommendations

• Forward dmesg and /var/log/kern.log to a central log platform and alert on repeated NVIDIA driver warnings
• Track local privilege use and sudden privilege escalations on GPU-equipped hosts
• Baseline normal GPU workload patterns so anomalous ioctl rates trigger investigation

How to Mitigate CVE-2026-24198

Immediate Actions Required

• Inventory all Linux hosts running the NVIDIA GPU Display Driver and identify the installed driver branch and version
• Apply the updated NVIDIA GPU Display Driver for Linux as published in the NVIDIA Security Bulletin (Answer ID 5821)
• Restrict local access on GPU hosts to trusted administrators and reduce the number of accounts with high privileges

Patch Information

NVIDIA has published fixed driver versions through its security bulletin. Administrators should consult the NVIDIA Security Bulletin (Answer ID 5821) to identify the patched version that matches the deployed driver branch. The authoritative CVE record is available at the NVD CVE-2026-24198 Detail and the CVE.org Record CVE-2026-24198.

Workarounds

• Limit shell and SSH access on GPU hosts to administrators required for operations
• Enforce least privilege so that workloads run without the elevated rights required to reach the vulnerable driver path
• Isolate sensitive workloads onto dedicated GPU hosts that do not share user sessions with untrusted code

# Verify installed NVIDIA driver version on Linux
nvidia-smi --query-gpu=driver_version --format=csv,noheader

# Restrict access to NVIDIA device nodes to a dedicated group
sudo groupadd -f nvidia-users
sudo chgrp nvidia-users /dev/nvidia*
sudo chmod 0660 /dev/nvidia*