EUVD-2026-52816
GHSA-q548-vjqw-xrpx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Network vector confirmed by inference server role; AC:H reflects inherent race timing dependency; PR:N since no auth gates inference requests; C:N as no data disclosure path is described.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering.
AnalysisAI
Race condition during LoRA manager singleton initialization in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to cause denial of service or corrupt inference data by exploiting a TOCTOU flaw in concurrent initialization paths. The CVSS vector assigns high availability impact alongside low integrity impact, reflecting that service crashes are the primary outcome while data tampering represents a secondary, harder-to-achieve consequence. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Technical ContextAI
NVIDIA Dynamo is an AI inference optimization framework for Linux designed for serving large language models at scale (CPE: cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:*). LoRA (Low-Rank Adaptation) is a parameter-efficient fine-tuning technique used to adapt base LLMs; the LoRA manager in Dynamo handles loading and lifecycle of these adapters as a singleton - a design pattern ensuring only one instance exists globally. CWE-367 (Time-of-Check Time-of-Use / TOCTOU) is the root cause: two or more concurrent threads can each observe the singleton as uninitialized, both proceed to initialize it, and the resulting unsynchronized writes corrupt shared state. In an inference serving context this can manifest as a crashed worker process (DoS) or as a request being served with a partially-initialized or wrong LoRA adapter (data tampering / integrity impact).
RemediationAI
Upgrade NVIDIA Dynamo to a version beyond v1.1.0 per the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842. A patched release version is not independently confirmed from the available references - consult that advisory directly for the exact fixed version. As a compensating control while patching is pending, restrict concurrency to the LoRA manager initialization path by ensuring Dynamo workers are pre-warmed in a single-threaded startup phase before accepting inference traffic, which reduces the window for the race to occur; the trade-off is a longer cold-start time. Blocking external network access to the Dynamo inference endpoint via firewall rules can eliminate the AV:N attack path but will prevent legitimate client access. Monitor worker process health and set up automated restarts to reduce DoS impact duration.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attacker
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or ta
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilitie
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbi
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attacke
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows una
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resou
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthen
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attac
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attack
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today