CVE-2026-24184 is a buffer overflow in the Link Layer Discovery Protocol (LLDP) daemon in NVIDIA Cumulus Linux. The record scores it 7.5 (High). An unauthenticated attacker on the adjacent network could send crafted LLDP frames and might achieve code execution. NVIDIA lists fixes in 5.16, 5.11.5 and 5.9.5.
What's affected
NVIDIA's August 2026 security bulletin for Cumulus Linux and NVOS lists these ranges. Cumulus Linux GA releases up to 5.16 are affected, with the fix in 5.16. Long term support 5.11 up to 5.11.5 is affected, fixed in 5.11.5. Long term support 5.9 up to 5.9.5 is affected, fixed in 5.9.5. Custom builds are also affected, so contact your NVIDIA account manager for a patched build.
The NVIDIA bulletin gives CVSS 3.1 7.5 (High) with an adjacent vector and high attack complexity, the same as the record, so the sources agree here. We read the bulletin's raw markdown; check the NVIDIA Enterprise Support Portal for the current state.
Weakness class: CWE-120, classic buffer copy without checking input size.
How to check if you're exposed
On a Cumulus Linux switch, run nv show system or cat /etc/os-release to read the release, and compare with the ranges above. Check each switch in a fabric, because switches are often upgraded in waves.
To see where the exposure sits, list which switch ports run lldpd and which neighbours they talk to. LLDP frames do not cross routers, so the attacker has to be on the same layer 2 segment as a switch port that accepts LLDP. Ports facing servers you do not fully control, shared racks or customer equipment are the ones that matter most.
What to do now
- Schedule upgrades to Cumulus Linux 5.16, 5.11.5 or 5.9.5 following your release line, using the NVIDIA Enterprise Support Portal.
- For custom builds, ask NVIDIA through your account manager for patched versions.
- Where policy allows, disable LLDP on ports that face untrusted equipment until the upgrade is done. NVIDIA lists no workaround itself, so treat this as your own judgement and test it first.
- Review physical and layer 2 access to switch ports in shared or colocated spaces.
- After upgrading, confirm the version on every switch and record it in your inventory.
Why it matters
LLDP is a discovery protocol that switches parse automatically from any neighbour. A parser for an unauthenticated protocol that runs as a privileged daemon is a natural place for a memory bug to matter. The buffer overflow class (CWE-120) lets input larger than the buffer overwrite adjacent memory, and NVIDIA says it could lead to code execution.
The adjacent vector and high attack complexity lower the likelihood compared with a bug reachable from the internet. Network devices, though, are rarely monitored like servers, and compromise of a top of rack switch gives an attacker a view of traffic. The KEV flag is false and NVIDIA's bulletin does not report exploitation. Patch in your next window and prioritise switches in shared spaces.
Quick check
Can this be exploited from the internet?
No. The vector is adjacent, so the attacker must be on the same network segment as the switch.
Is there a workaround?
NVIDIA's bulletin lists none. The fix is an upgrade.
Sources
Last reviewed: 18 October 2026.
