CVE-2026-24260
NVIDIA Container Toolkit: NVIDIA Container Toolkit: Privilege escalation and code execution via race condition
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 1, 2026
Updated · July 8, 2026
Description
A flaw was found in NVIDIA Container Toolkit. An attacker could exploit a time-of-check time-of-use (TOCTOU) race condition. This vulnerability might allow an attacker to achieve code execution, escalate privileges, and tamper with data.
Statement
A flaw was found in NVIDIA Container Toolkit versions through 1.19.0, where a time-of-check time-of-use (TOCTOU) race condition could allow an attacker to achieve code execution, privilege escalation, and data tampering. Red Hat ships NVIDIA Container Toolkit version 1.19.1 in RHEL 9 and RHEL 10, which includes the fix for this vulnerability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition