CVE-2026-24260
Possible ATT&CK Techniques 3AI
T1055 · Process Injection T1203 · Exploitation for Client Execution T1068 · Exploitation for Privilege EscalationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NVIDIA | Container Toolkit | All versions up to and including 1.19.0 | affected |
| NVIDIA | GPU Operator | All versions up to and including 26.3.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-24260
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NVIDIA | Container Toolkit | All versions up to and including 1.19.0 | - | |
| NVIDIA | GPU Operator | All versions up to and including 26.3.1 | - |
II. Public POCs for CVE-2026-24260
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-24260
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-24260 (2)
Other References for CVE-2026-24260 (1)
Same Patch Batch · NVIDIA · 2026-07-01 · 17 CVEs total
| CVE-2026-24270 | 9.8 CRITICAL | NVIDIA AIStore 1.x认证绕过漏洞 |
| CVE-2025-23351 | 9.0 CRITICAL | NVIDIA ConnectX/BlueField越界写入漏洞 |
| CVE-2025-23350 | 9.0 CRITICAL | NVIDIA ConnectX/BlueField越界写入漏洞 |
| CVE-2026-24251 | 7.8 HIGH | NVIDIA Megatron Bridge Linux提权与代码执行漏洞 |
| CVE-2026-24250 | 7.8 HIGH | NVIDIA Megatron Bridge输入验证漏洞致提权 |
| CVE-2026-24249 | 7.8 HIGH | NVIDIA Megatron Bridge Linux反序列化漏洞 |
| CVE-2026-24248 | 7.8 HIGH | NVIDIA Megatron Bridge代码生成控制漏洞 |
| CVE-2026-24247 | 7.8 HIGH | NVIDIA Megatron Bridge Linux反序列化漏洞 |
| CVE-2026-24246 | 7.8 HIGH | NVIDIA Megatron Bridge Linux代码执行漏洞 |
| CVE-2026-24245 | 7.8 HIGH | NVIDIA Megatron Bridge for Linux反序列化漏洞 |
| CVE-2026-24244 | 7.8 HIGH | NVIDIA Megatron Bridge Linux反序列化漏洞 |
| CVE-2026-24243 | 7.8 HIGH | NVIDIA Megatron Bridge for Linux反序列化漏洞 |
| CVE-2026-24242 | 7.8 HIGH | NVIDIA Megatron Bridge 存在 SSRF 漏洞可导致信息泄露 |
| CVE-2026-24240 | 7.8 HIGH | NVIDIA Megatron Bridge Linux代码执行漏洞 |
| CVE-2026-24264 | 7.5 HIGH | NVIDIA Triton Inference Server Denial of Service漏洞 |
| CVE-2026-24266 | 5.9 MEDIUM | NVIDIA Triton Inference Server 拒绝服务漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-367
- CVE-2026-55950
DTLS listener crash via race condition in dtls_packet_demux - CVE-2026-14160
Samsung Escargot bab3a57 TOCTOU竞争条件漏洞 - CVE-2026-57959
Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchrono - CVE-2026-13742
Lack of signature verification before execution of downloade - CVE-2026-54370
acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/cha
V. Comments for CVE-2026-24260
No comments yet