CVE-2026-24187: Use-After-Free in the NVIDIA Linux Display Driver -- May 2026
| CVE | Score | Component | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2026-24187 | 8.8 High | NVIDIA Display Driver — Linux | R595 v596.36 / Linux 590.48.01+ | May 2026 |
For executives
NVIDIA's May 2026 GPU display driver bulletin patched 14 vulnerabilities across the driver stack. The most severe, CVE-2026-24187, is a use-after-free in the NVIDIA display driver for Linux rated CVSS 8.8. A local attacker can trigger it to achieve code execution, privilege escalation, data theft, information disclosure, and system crashes. It is the most severe single vulnerability in any NVIDIA display driver bulletin since the mid-2024 cluster.
Use-after-free vulnerabilities occur when code retains a reference to a memory region after that region has been freed. If the allocator subsequently assigns that freed memory to another object, the original reference now points to memory containing unexpected data. In a kernel-mode GPU driver, use-after-free is particularly consequential because the driver operates across all GPU-related operations on the system simultaneously.
The May 2026 bulletin cluster
CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 cover path traversal vulnerabilities — unauthorised system changes and access to underlying system files through directory traversal. Additional high-severity flaws affect the kernel-mode layer on both Windows and Linux, including improper GPU resource access, a TOCTOU issue in driver resource handling, and a driver-lock leak.
Patched versions
Windows: GeForce driver version 596.36 (R595 branch) or newer. Linux: driver version 590.48.01 or newer. The 570 driver series reached end-of-life status with this bulletin and does not receive fixes.
Context
CVSS 8.8 for CVE-2026-24187 represents an escalation from the October 2025 bulletin's highest score of 7.0 and continues the use-after-free pattern in the Linux driver that the Quarkslab team highlighted in October 2025. NVIDIA is now publishing security bulletins to GitHub in Markdown, CSAF, and CVE formats since October 2025.