Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-24184

CVE-2026-24184HIGH

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated atta…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   N  U  H  H  H    8.8   .0031   22.0     —

AFFECTED
  Product            Versions         Fixed
  Cumulus Linux GA   0.0 to 5.16 –    —
  Cumulus Linux LTS  0.0 to 5.11.5 –  —
  Cumulus Linux LTS  0.0 to 5.9.5 –   —

TIMELINE
  Jan 21  Reserved by nvidia
  Aug 18  Published (CNA: nvidia)
  Sep 2   RESCORED — CVE-2026-24184 (NVIDIA Cumulus Linux GA). CVSS 7.5 → 8.8 (NVD).

CWE-120 · CNA: nvidia · CVSS v3.1 · 3 references · NVD status: Analyzed

Description

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 21, 2026	Reserved	Reserved by nvidia
August 18, 2026	Published	Published (CNA: nvidia)
September 2, 2026	RESCORED	RESCORED — CVE-2026-24184 (NVIDIA Cumulus Linux GA). CVSS 7.5 → 8.8 (NVD).

Affected

Affected products and packages — 3 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
NVIDIA	Cumulus Linux GA	—	0.0 to 5.16	—
NVIDIA	Cumulus Linux LTS	—	0.0 to 5.11.5	—
NVIDIA	Cumulus Linux LTS	—	0.0 to 5.9.5	—

Weaknesses

CWE-120

References (3)

https://github.com/NVIDIA/product-security/tree/main/2026/5817 [Patch]
https://nvd.nist.gov/vuln/detail/CVE-2026-24184 [US Government Resource]
https://www.cve.org/CVERecord?id=CVE-2026-24184 [Third Party Advisory]

Authoritative record: CVE-2026-24184 at cve.org

Vendors: nvidia

Weaknesses: CWE-120

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24184 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.