Brief Summary: NVIDIA Linux Display Driver CVE-2026-24187 Use After Free Vulnerability

Introduction

A use-after-free vulnerability in the NVIDIA Linux display driver lets a local attacker with low privileges potentially escalate privileges, execute arbitrary code, or cause denial of service, with no user interaction required. The flaw, CVE-2026-24187, carries a CVSS 8.8 rating and spans many driver branches. Organizations running NVIDIA GPUs in shared Linux environments, such as GPU compute clusters, multi-tenant research workstations, or virtualized infrastructure with vGPU, should give it immediate attention.

Technical Information

CVE-2026-24187 is a use-after-free condition (CWE-416) in the Linux kernel-mode layer of the NVIDIA display driver. A use-after-free happens when software keeps referencing memory after that memory has been freed. If the freed memory is later reallocated and an attacker can influence its contents, the attacker may be able to corrupt program state or hijack execution flow.

CVSS Vector Analysis

The CVE record gives a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H with a base score of 8.8. The metrics break down as follows:

• Attack Vector: Local. The attacker needs local access to the target system.
• Attack Complexity: Low. No special conditions or race windows are required.
• Privileges Required: Low. A standard unprivileged user account is enough.
• User Interaction: None. No action from another user is needed.
• Scope: Changed. Exploitation can affect resources beyond the vulnerable component's own security boundary.
• Confidentiality, Integrity, Availability: High on all three.

The Changed scope indicates that a successful exploit crosses a trust boundary, which is consistent with escalation from a low-privilege user context into kernel-level or driver-level execution.

Tenable scored the vulnerability independently at CVSS v3.0 base 7.8 with Unchanged scope (S:U), and at CVSS v2 base 4.6 with partial CIA impacts. The scores differ mainly on the scope metric, but both assessments agree on local, low-complexity, low-privilege exploitation with high impact.

Exploitation Scenario

On a Linux system running an affected NVIDIA driver, a local user could trigger the use-after-free to achieve:

• Denial of service: crashing the driver or the entire system.
• Privilege escalation: gaining kernel-level access from an unprivileged account.
• Information disclosure: reading memory contents that should be inaccessible.
• Data tampering: modifying data processed by the driver stack.
• Code execution: running arbitrary code in a privileged context.

The risk is highest in multi-tenant environments, GPU compute clusters, and any Linux deployment where several users share GPU resources or where GPU-accelerated workloads run under non-root service accounts. A compromised process or a malicious local user could use this flaw to break out of their privilege boundary.

Additional Context

The vulnerability was credited to researcher Yegor Vasilenko. NVIDIA's kernel-mode GPU driver is proprietary and closed source, so no source code diff or commit is publicly available. The fix ships only in updated binary driver packages.

CVE-2026-24187 affects only Linux drivers. It does not appear in any of the Windows-specific CVE remediation tables in NVIDIA's May 2026 bulletin.

The three published scores compare as follows:

Patch Information

NVIDIA patched CVE-2026-24187 in its May 2026 GPU Display Driver Security Bulletin (answer ID 5821). The bulletin was first published on May 19, 2026, and revised through May 21 to correct several driver version errors in its tables.

Standalone Linux GPU Display Driver (GeForce, NVIDIA RTX/Quadro/NVS, Tesla)

NVIDIA vGPU Software: Linux Guest Driver

NVIDIA vGPU Manager (XenServer, VMware vSphere, RHEL KVM, Ubuntu)

The NVIDIA Cloud Gaming Linux Guest Driver and vGPU Manager are patched to the same driver versions shown above. They are distributed under the "April 2026 Release" label through the NVIDIA Licensing Portal.

R570 branch end of life: NVIDIA confirmed to GamingOnLinux that the R570 branch has reached end-of-life status and will not receive a security fix for CVE-2026-24187. Users still on R570 must migrate to a supported branch (R535, R580, or R595) to get the patch.

Consumer users can download updated drivers from the NVIDIA Driver Downloads page. Enterprise and vGPU customers must get updates through the NVIDIA Licensing Portal. Tenable has published Nessus plugin 316514 (published May 22, 2026), which detects unpatched Linux systems from their self-reported driver version numbers.

Affected Systems and Versions

CVE-2026-24187 affects Linux only. The following components and version ranges are vulnerable:

Standalone Linux Display Drivers:

• R595 branch: all versions prior to 595.71.05
• R580 branch: all versions prior to 580.159.03
• R535 branch: all versions prior to 535.309.01
• R570 branch: all versions (end of life, no fix available; migration required)

These apply across the GeForce, NVIDIA RTX, Quadro, NVS, and Tesla product lines on Linux.

vGPU Guest Drivers (Linux):

• vGPU software up to 20.0 with driver 595.58.03
• vGPU software up to 19.4 with driver 580.126.09
• vGPU software up to 16.13 with driver 535.288.01

Virtual GPU Manager:

• vGPU software up to 20.0 with driver 595.58.02
• vGPU software up to 19.4 with driver 580.126.08
• vGPU software up to 16.13 with driver 535.288.01

Windows display drivers are not affected by this CVE.

References

• NVD: CVE-2026-24187
• CVE Record: CVE-2026-24187
• Security Bulletin: NVIDIA GPU Display Drivers, May 2026
• NVIDIA Product Security
• Tenable: CVE-2026-24187
• Tenable Nessus Plugin 316514: NVIDIA Linux GPU Display Driver (May 2026)
• GamingOnLinux: NVIDIA reveal more GPU driver security flaws for May 2026
• CWE-416: Use After Free (Mondoo)
• CWE-416 Vulnerability Overview (Backslash Security)