CVE-2026-24184

Analyzed Analyzed - Analysis Complete

Buffer Overflow in NVIDIA Cumulus Linux LLDP Daemon

Publication date: 2026-08-18

Last updated on: 2026-09-02

Assigner: NVIDIA Corporation

Description

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-02

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-24184

EUVD

EUVD-2026-61104

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	cumulus_linux	to 5.16.0 (inc)
nvidia	cumulus_linux	to 5.11.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in NVIDIA Cumulus Linux's Link Layer Discovery Protocol (LLDP) daemon. An unauthenticated attacker on the same network segment can send specially crafted LLDP frames to trigger the overflow. Successful exploitation may allow arbitrary code execution.

Detection Guidance

Monitor network traffic for unusual LLDP frames. Use tools like tcpdump to capture LLDP traffic: tcpdump -i any -c 100 -nn -e -vv ether proto 0x88cc. Check for malformed or excessively large LLDP frames which may indicate exploitation attempts.

Impact Analysis

An attacker could gain control of affected systems by exploiting this flaw, leading to potential data breaches, system compromise, or disruption of network services. The attack requires proximity to the target network but no user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance penalties if systems storing sensitive data are compromised due to this flaw.

Mitigation Strategies

Update Cumulus Linux to a patched version as recommended by NVIDIA. Disable LLDP service if not required: systemctl stop lldpd && systemctl disable lldpd. Implement network segmentation to limit adjacency-based attacks. Monitor for suspicious activity in LLDP traffic.

Hi! I’m here to help you understand CVE-2026-24184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70