CVE-2026-24196: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

CVE-2026-24196 is an out-of-bounds read vulnerability in the NVIDIA Display Driver for Linux that can be triggered by a local user with low privileges. A successful exploit may lead to denial of service and information disclosure. The vulnerability affects NVIDIA GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest driver product lines across multiple driver branches, with fixed versions including 580.159.03, 595.71.05, and 535.309.01 depending on the product line. It was published on May 26, 2026, and carries a CVSS v3.1 base score of 7.1 (High), assigned by NVIDIA Corporation (GitHub Advisory, NVIDIA Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), where the NVIDIA Display Driver for Linux reads data beyond the intended buffer boundary. An attacker with local access and low privileges can craft inputs that cause the driver to read memory outside its allocated region, without requiring user interaction or elevated privileges. The attack vector is local with low complexity, meaning no special conditions or race conditions are needed to trigger the flaw. No public technical write-up or proof-of-concept code has been identified at this time (GitHub Advisory, NVIDIA Advisory).

Successful exploitation can result in two primary consequences: denial of service (crashing the display driver) and information disclosure (reading sensitive memory contents beyond intended boundaries). A local user with low privileges could leverage this vulnerability to expose kernel or driver memory, potentially revealing sensitive data such as cryptographic material or other process information. Integrity is not directly impacted, and the scope is unchanged, meaning the vulnerability does not inherently enable lateral movement to other system components (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.012% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory, NVIDIA Advisory).

NVIDIA has released patched driver versions to address this vulnerability. Users should update to the following versions or later based on their product line:

• GeForce, RTX/Quadro/NVS, Tesla (R580 branch): 580.159.03
• GeForce, RTX/Quadro/NVS, Tesla (R595 branch): 595.71.05
• GeForce, RTX/Quadro/NVS, Tesla (R535 branch): 535.309.01
• vGPU Guest driver: Update beyond vGPU 16.13, 19.4, or 20.0 depending on the branch in use.

As a temporary measure, restricting local user access to systems running vulnerable driver versions is recommended. SUSE has also issued a security update (SUSE-SU-2026:21878-1) for affected Linux distributions (NVIDIA Advisory, SUSE Advisory).

NVIDIA disclosed this vulnerability as part of a broader May 2026 security advisory covering 14 vulnerabilities in its Windows and Linux drivers (Gaming on Linux, IRC Junkie). SUSE issued a corresponding security update for its Linux distribution, and Amazon Linux 2023 also published an advisory (ALAS2023NVIDIA-2026-292). Coverage has been largely routine, with no significant community controversy or notable researcher commentary beyond standard vulnerability tracking.