PatchSiren cyber security CVE debrief

CVE-2026-24182 NVIDIA CVE debrief

A vulnerability in NVIDIA Display Driver for Windows and Linux allows an attacker with local access to leak held driver locks, potentially causing denial of service. The issue stems from improper lock handling (CWE-667) and carries a CVSS 3.1 score of 6.5 (Medium severity). The attack requires low complexity and local access with low privileges, but no user interaction. The vulnerability was published to NVD on 2026-05-26 and is currently undergoing analysis. NVIDIA has published security guidance through their customer help portal.

Vendor: NVIDIA
Product: GeForce
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-26
Original CVE updated: 2026-05-26
Advisory published: 2026-05-26
Advisory updated: 2026-05-26

Who should care

Organizations running NVIDIA graphics hardware on Windows or Linux workstations and servers, particularly those in multi-user environments where local access restrictions may be limited. System administrators responsible for graphics driver maintenance and security patching should prioritize monitoring for NVIDIA's remediation guidance.

Technical summary

The vulnerability exists in NVIDIA Display Driver implementations for both Windows and Linux operating systems. An attacker with local access and low privileges can exploit improper locking mechanisms (CWE-667) to leak held driver locks. This lock leakage can destabilize the driver and potentially cause system-wide denial of service. The attack vector is local with low attack complexity, requiring no user interaction. The scope is changed (S:C) indicating impact beyond the vulnerable component. The confidentiality and integrity impacts are none, but availability impact is high.

Defensive priority

medium

Recommended defensive actions

Review NVIDIA security notice for affected driver versions and update guidance
Identify systems running NVIDIA Display Driver on Windows and Linux platforms
Apply vendor-provided driver updates when available
Monitor NVIDIA security advisories for additional technical details
Consider restricting local access to systems with NVIDIA graphics drivers where feasible

Evidence notes

The vulnerability description and CVSS scoring are sourced from NVD official records. The CWE-667 (Improper Locking) classification is attributed to NVIDIA PSIRT. Vendor identification is marked low confidence based on reference domain analysis of 'Custhelp' (NVIDIA's support portal). The official NVIDIA security notice is referenced through their customer help system.

Official resources

NVIDIA disclosed this vulnerability through their PSIRT channel with NVD publication on 2026-05-26. The entry was modified later the same day. No known exploitation in the wild has been reported, and the vulnerability is not listed in CISA|