CVE-2026-24260: NVIDIA Container Toolkit Race Condition Privilege Escalation

Technical summary

CVE-2026-24260 is a TOCTOU race condition (CWE-367) in NVIDIA Container Toolkit for Linux. The vulnerability exists in a code path where the toolkit performs a security check, but an attacker with local or authenticated access can race to modify state or resources between that check and the subsequent operation that relies on it. This allows circumvention of intended access controls. The attack requires prior authentication (PR:L) but can then cascade to arbitrary code execution within or outside the container context, privilege escalation, and data integrity violations. The CVSS 3.1 vector reflects the high impact (C:H/I:H/A:H) but acknowledges the authentication prerequisite and non-trivial attack complexity.

Business impact

Organizations deploying NVIDIA Container Toolkit in production container orchestration environments face risk of insider or supply-chain-sourced attacks leading to container escape, privilege escalation to host or cluster level, and data exfiltration or corruption. This is particularly critical in multi-tenant Kubernetes clusters, GPU-accelerated ML pipelines, and data-sensitive workloads. The vulnerability could compromise CI/CD pipeline integrity, allow lateral movement within infrastructure, and undermine container isolation guarantees.

Affected systems

NVIDIA Container Toolkit for Linux is the confirmed affected component. This tool is commonly integrated into container runtimes, Docker configurations, and Kubernetes node setups to enable GPU access within containers. Any Linux system running NVIDIA Container Toolkit—whether standalone or as part of a larger container platform—is potentially affected. Verify the specific toolkit version in use against NVIDIA's official advisory for precise affected version ranges and patch availability.

Exploitability

The vulnerability requires an authenticated user with local or local-equivalent access (PR:L), reducing immediate exposure to public internet attack. However, it is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the source date, meaning active exploitation in the wild has not been officially documented. The attack complexity is rated as high (AC:H), reflecting the tight timing window and race condition mechanics that must be triggered correctly. This does not mean exploitation is impractical; rather, it requires precision and understanding of the toolkit's internal timing.

Remediation

Apply the security patch released by NVIDIA corresponding to this CVE. Verify the exact patched version against NVIDIA's official security advisory. In the interim, restrict authentication to Container Toolkit and underlying container runtimes to trusted users only. Review and enforce least-privilege access controls for accounts that can invoke container operations. Monitor for suspicious process spawning or privilege elevation attempts within containers. If a patch is not immediately available or deployable, isolate affected systems or containers until remediation is complete.

Patch guidance

Contact NVIDIA or consult their official security advisory for the specific patched version of Container Toolkit for Linux. Apply patches during a maintenance window after validating compatibility with your container runtime, Kubernetes version, and GPU driver stack. Test the patch in a non-production environment first, as Container Toolkit updates can affect GPU passthrough and container startup behavior. Verify that post-patch systems can successfully spawn GPU-enabled containers before broad rollout.

Detection guidance

Monitor for unusual process creation or privilege escalation events originating from container contexts, especially those involving the Container Toolkit binaries or device nodes. Look for rapid repeated calls to Container Toolkit APIs or syscalls that might indicate race condition attempts. Audit authentication logs for unexpected privilege escalation or lateral movement from users with Container Toolkit access. Enable seccomp or AppArmor profiles on container runtimes to restrict suspicious syscall patterns. Review container image registries and CI/CD pipelines for unauthorized or suspicious modifications that might exploit this window.

Why prioritize this

HIGH severity is warranted due to the potential for unauthenticated remote privilege escalation leading to container escape in shared infrastructure. Although authentication is required (lowering immediate public risk), the broad impact scope (confidentiality, integrity, availability, system scope change) and prevalence of NVIDIA Container Toolkit in GPU-accelerated cloud and HPC environments make this a priority for organizations with those deployments. Not yet listed on KEV means time to act before active exploitation campaigns begin.

Risk score, explained

CVSS 3.1 score of 8.5 reflects HIGH severity: (1) High impact on confidentiality (C:H), integrity (I:H), and availability (A:H) due to code execution and privilege escalation potential; (2) Network-adjacent or local attack vector with system-wide scope change (S:C); (3) Mitigation by authentication requirement (PR:L) and high attack complexity (AC:H), preventing a critical score. Organizations should treat this as a priority patch target, especially those running multi-tenant or sensitive-data container workloads.

Frequently asked questions