CVE-2026-24197: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

CVE-2026-24197 is a vulnerability in the NVIDIA Display Driver for Linux affecting Multi-Instance GPU (MIG) partition management. The flaw involves insecure default initialization of memory subsystem routing resources, which can lead to data corruption or a system hang during GPU partition reconfiguration, ultimately resulting in denial of service. It was published on May 26, 2026, and affects NVIDIA GeForce, Tesla, RTX/Quadro/NVS, and Virtual GPU Manager products across multiple driver branches on Linux. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), assigned by NVIDIA Corporation (Github Advisory, NVIDIA Advisory).

The root cause is classified as CWE-1188 (Insecure Default Initialization of Resource), where memory subsystem routing resources within the MIG partition management subsystem are not securely initialized by default. The attack vector is local, requiring low privileges and no user interaction, but the scope is changed — meaning the impact can extend beyond the vulnerable component itself. An attacker with local, low-privileged access can trigger data corruption or a hang by initiating GPU partition reconfiguration operations while the routing resources are in an insecurely initialized state. No public proof-of-concept or technical write-up detailing specific exploitation mechanics has been identified (Github Advisory, NVIDIA Advisory).

Successful exploitation results in denial of service by causing data corruption or a system hang during GPU partition reconfiguration, rendering the GPU unavailable to other users or workloads. There is no confidentiality or integrity impact identified; the primary consequence is high availability impact on the GPU subsystem. In multi-tenant or virtualized environments using MIG (common in AI/ML and HPC workloads), a low-privileged user could disrupt GPU availability for all co-located workloads, making this particularly relevant in cloud and data center deployments (Github Advisory, NVIDIA Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2026-24197. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory).

NVIDIA has released patched driver versions addressing this vulnerability. Users should upgrade to the following versions or later:

• Tesla: 535.309.01, 580.159.03, or 595.71.05
• GeForce: 535.309.01, 580.159.03, or 595.71.05
• RTX, Quadro, NVS: 535.309.01, 580.159.03, or 595.71.05
• Virtual GPU Manager: vGPU 19.4 (580.126.08 / 582.16) or vGPU 20.0 (595.58.02 / 595.94)

As interim mitigations, restrict local system access to minimize exposure to low-privileged users, and monitor GPU partition reconfiguration activities for anomalies. SUSE has also released a security update (SUSE-SU-202621878-1) and Amazon Linux 2023 has issued ALAS2023NVIDIA-2026-292 (NVIDIA Advisory, SUSE Advisory, Amazon Advisory).

Gaming on Linux covered the disclosure as part of a broader report on NVIDIA's May 2026 GPU driver security fixes, noting multiple vulnerabilities addressed in the release (Gaming on Linux). IRC-Junkie reported that NVIDIA fixed 14 vulnerabilities across its Windows and Linux drivers in this advisory cycle (IRC-Junkie). No significant researcher commentary or social media discussion specific to CVE-2026-24197 has been identified beyond standard vulnerability tracking coverage.