January & May 2026 GPU Display Driver Bulletins
| Bulletin | Key Characteristics | Disclosed |
|---|---|---|
| January 2026 | Kernel-mode driver vulnerabilities — improper GPU resource access, TOCTOU, driver-lock leak | January 28, 2026 |
| May 2026 (non-CVE-2026-24187) | Path traversal trio (CVE-2026-34908/34909/34910), kernel-mode cluster | May 2026 |
For executives
Two GPU display driver security bulletins bookend the first half of 2026. The January 2026 bulletin addresses a kernel-mode driver vulnerability cluster covering improper GPU resource access, a TOCTOU issue in driver resource handling, and a driver-lock leak. The May 2026 bulletin contains the highest-severity single CVE in recent NVIDIA driver history (CVE-2026-24187, covered separately) alongside a path traversal trio and further kernel-mode issues.
January 2026: the kernel-mode driver cluster
- Improper GPU resource access: a local attacker can access GPU resources they are not authorised to use — memory pools, compute contexts, scheduling slots assigned to other processes.
- TOCTOU issue in driver resource handling: the driver checks that a resource is in a valid state, then performs an operation. An attacker action between check and operation can change the resource state.
- Driver-lock leak: improper handling of a locking primitive — when the driver releases a lock, the lock state or locked resource is not properly cleaned up.
Patched versions for January 2026
Windows GPU display driver: version 591.55 or later. Linux: version 570.124.06 or later. Published January 28, 2026.
May 2026: the path traversal trio
CVE-2026-34908 allows unauthorised system changes. CVE-2026-34909 allows access to underlying system files. CVE-2026-34910 is the third in the cluster.
Why these bulletins matter for AI infrastructure teams
The January 2026 bulletin was the first published simultaneously on GitHub in Markdown, CSAF, and CVE formats. GPU servers running production training and inference operate under exactly the conditions that stress kernel-mode driver synchronisation: multiple concurrent processes competing for GPU resources, high throughput memory allocation and deallocation, and sustained GPU utilisation.