AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-5jv2-g5wq-cmr4: vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

mediumvulnerability

security

Source: Hugging Face Security AdvisoriesJune 17, 2026CVE-2026-53923

Summary

vLLM's GGUF dequantize kernels (specialized functions for decompressing quantized neural network weights) use a 32-bit integer parameter to specify tensor size, which truncates when processing very large tensors. This causes the output tensor to be only partially filled by the processing kernel, leaving the remaining memory uninitialized. In multi-tenant deployments (where multiple users share GPU hardware), this unfilled memory may retain sensitive data from other users' previous requests, leaking their information.

Solution / Mitigation

Change the `int k` parameter to `int64_t k` in the `to_cuda_ggml_t` function pointer type declaration at `ggml-common.h:1067`. The source text states: "This is a single root cause -- the `int` type on the `k` parameter in `to_cuda_ggml_t` -- with a single fix: change `int k` to `int64_t k`. All dequantize functions inherit this type through the same typedef."