PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24199 NVIDIA CVE debrief

A race condition vulnerability exists in NVIDIA Display Driver for Linux within a kernel module. The flaw stems from improper memory ordering controls, allowing a local attacker to trigger a denial of service condition by manipulating compiler or processor memory instruction ordering. The attack requires local access with low privileges, and successful exploitation results in system availability impact without confidentiality or integrity compromise.

Vendor
NVIDIA
Product
GeForce
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-27
Advisory published
2026-05-26
Advisory updated
2026-05-27

Who should care

Linux system administrators managing workstations or servers with NVIDIA graphics hardware; security teams tracking kernel-level driver vulnerabilities; organizations with high-availability requirements for GPU-accelerated workloads

Technical summary

The vulnerability resides in a kernel module component of NVIDIA Display Driver for Linux. Insufficient synchronization primitives allow memory instruction reordering by compilers or processors, creating a race condition window. An attacker with local low-privilege access can exploit this timing-dependent flaw to destabilize the kernel module, resulting in denial of service. The high attack complexity (AC:H) reflects the precise timing requirements for successful exploitation. No code execution, privilege escalation, or information disclosure capabilities are indicated in available technical details.

Defensive priority

medium

Recommended defensive actions

  • Apply NVIDIA security update 5821 when available per vendor security bulletin
  • Restrict local access to systems running affected NVIDIA Display Driver for Linux versions
  • Monitor for anomalous kernel module behavior or unexpected system crashes
  • Review compiler and processor memory barrier implementations in custom kernel modules interacting with NVIDIA drivers
  • Subscribe to NVIDIA security notifications for patch availability updates

Evidence notes

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector, high attack complexity, low privileges required, no user interaction, and high availability impact. The NVD entry shows vulnStatus 'Undergoing Analysis' as of source capture.

Official resources

NVIDIA disclosed this vulnerability on 2026-05-26 via their Product Security Incident Response Team (PSIRT). The issue was published to the National Vulnerability Database (NVD) the same day and subsequently modified approximately 52 min 46