vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-53923
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 22, 2026
- Source last modified
- October 25, 2026
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is allocated at full size via torch::empty (uninitialized memory), but the dequantize CUDA kernel processes only a truncated number of elements. The unfilled portion of the output tensor retains whatever was previously in GPU memory. In multi-tenant inference deployments, this residual GPU memory may contain tensor data from other users' inference requests, constituting information disclosure. This vulnerability is fixed in 0.23.1rc0.
Description quoted from the NVD record.
Who is affected
This flaw affects vLLM, software that runs AI language models so that apps and people can send them questions and get answers. It affects versions 0.5.5 up to, but not including, 0.23.1rc0. The problem is in the part that unpacks compressed AI models stored in the GGUF file format on the graphics card. When it works on these models, part of the result can be left holding whatever was in the graphics card's memory before. Where one vLLM server is shared by several users, that leftover memory may hold data from other users' requests, exposing that information. This flaw is rated High.
What to do
- The person who installed or runs vLLM for your organization, or the IT provider or vendor who manages it, should act on this flaw.
- Check which version of vLLM is running. Any version from 0.5.5 up to, but not including, 0.23.1rc0 is affected.
- Update vLLM to version
0.23.1rc0, the version that fixes this flaw. - Give this update priority if one vLLM server is shared by several users, since that is the setup where other users' data may be exposed.
- If an IT provider or vendor runs vLLM for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.