CVE-2026-24195: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

CVE-2026-24195 is an improper input validation vulnerability in the NVIDIA Display Driver for Linux, specifically within the Unified Virtual Memory (UVM) component. A local user without elevated privileges can trigger the flaw to cause a denial of service condition. The vulnerability was published on May 26, 2026, and carries a CVSS v3.1 base score of 7.1 (High), assigned by NVIDIA Corporation (GitHub Advisory). Affected versions include Guest driver releases up to and including 595.58.03 (vGPU 20.0 and earlier) and 580.126.09 (vGPU 19.4 and earlier) (EUVD).

The vulnerability is classified as CWE-20 (Improper Input Validation) and resides in the UVM (Unified Virtual Memory) subsystem of the NVIDIA Linux display driver. A local user can supply malformed or unexpected input to the UVM component, bypassing validation checks and causing the driver to enter an unstable state. No authentication or user interaction is required, and the scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component itself. No public technical write-up or proof-of-concept code has been identified at this time (GitHub Advisory).

Successful exploitation results in a denial of service, potentially crashing or disabling the NVIDIA display driver service on the affected Linux system. Because the scope is "Changed," the disruption may affect resources or components beyond the driver itself, such as GPU-dependent workloads, virtual machine guests, or applications relying on GPU acceleration. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.013–0.015%, placing it in the low percentile for near-term exploitation likelihood. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

NVIDIA has released patched driver versions addressing this vulnerability; users should update to a version beyond the affected releases (Guest driver > 595.58.03 / vGPU > 20.0, or > 580.126.09 / vGPU > 19.4). The official NVIDIA security advisory is available at the NVIDIA customer help portal (answer ID 5821). As a compensating control, administrators should restrict local user access to systems running vulnerable driver versions where immediate patching is not feasible (NVIDIA Advisory). SUSE has also issued a security update (SUSE-SU-202621878-1) for affected NVIDIA open driver packages, and Amazon Linux 2023 has published a corresponding advisory (ALAS2023NVIDIA-2026-292).

Gaming on Linux covered the disclosure as part of a broader report on NVIDIA's May 2026 GPU driver security fixes, noting multiple vulnerabilities addressed in the release (Gaming on Linux). IRC-Junkie reported that NVIDIA fixed 14 vulnerabilities across its Windows and Linux drivers in this update cycle. No significant researcher commentary or social media discussion specific to CVE-2026-24195 has been identified beyond routine vulnerability tracking.