GHSA-5jv2-g5wq-cmr4: vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
- Identifiers
- CVE-2026-53923GHSA-5jv2-g5wq-cmr4
- Published
- Record updated
- Affected
- vllm >= 0.5.5, <= 0.23.0
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
vLLM's GGUF dequantize kernels in csrc/quantization/gguf/gguf_kernel.cu truncate tensor element counts because the to_cuda_ggml_t function pointer takes the count as a 32-bit int, while the caller passes m * n. The output tensors are allocated with torch::empty and left uninitialized, so when m * n exceeds INT_MAX the unfilled portion retains stale GPU memory. In multi-tenant serving this residual memory may contain other users' inference data, a silent confidentiality violation.
Mitigation
Change the int k parameter in the to_cuda_ggml_t typedef to int64_t k, which all dequantize functions inherit through the same typedef.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents
Topics
Related items
- MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
- LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
- Medium“Black October” for AI Developer PlatformsSimilar attack · Wiz Research Blog