Description

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:20:18.220Z",
  "pubdate": "2026-08-13T15:20:18.220Z",
  "executiveSummary": "An integer overflow vulnerability exists in the vLLM inference and serving engine prior to version 0.27.0. The flaw resides in the CUDA activation kernel implementation, specifically within the block index calculation affecting batched tensor operations. The vulnerability type is classified as an integer overflow leading to memory exposure and cross-tenant data leakage. The primary impact involves the unauthorized disclosure of sensitive inference outputs, where a request processed concurrently within the same inference batch can inadvertently receive a partial or complete copy of another user's processed data. Affected systems include deployments utilizing vLLM versions prior to 0.27.0 handling multi-tenant or batched large language model inference workloads. The risk implications are severe for environments processing confidential or proprietary user inputs and outputs, as confidentiality guarantees are violated at the hardware-accelerated batch processing layer. Attacker capabilities rely on the ability to submit inference requests to the shared serving engine, potentially timing or crafting requests to coincide with target batches. Exploitation requirements involve concurrent batch processing of user inputs where the mathematical calculation for memory offsets triggers the integer overflow condition.",
  "technicalDetails": "The root cause of the vulnerability stems from an arithmetic integer overflow occurring in the expression blockIdx.x * 2 * d located within the activation_kernels.cu file, specifically inside the act_and_mul_kernel function. In CUDA programming, blockIdx.x represents the block index within the grid, and multiplication with scaling factors such as 2 and the hidden dimension size d can exceed the maximum representable value of the standard integer type depending on the batch dimensions and tensor sizes. When this integer overflow occurs, the resulting memory offset calculation wraps around to an incorrect or negative value.\nThe vulnerable component is the CUDA activation kernel file activation_kernels.cu, which handles activation functions combined with multiplication operations for batched tensor computations in large language models. The affected software versions comprise all vLLM releases prior to version 0.27.0. The issue does not inherently require authentication or specific privilege levels beyond the baseline capability to interact with the vLLM serving endpoint and submit inference requests. The network exposure corresponds to the standard API or serving interfaces exposed by vLLM for model inference.\nThe step-by-step attack flow proceeds as follows: First, multiple users or clients submit independent inference requests that the vLLM engine aggregates into a single batched execution queue to optimize GPU utilization. Second, during the execution of the batched inference, the GPU invokes the act_and_mul_kernel function in activation_kernels.cu to perform activation operations. Third, the multiplication involving blockIdx.x * 2 * d triggers an integer overflow due to large tensor dimensions or specific batch configurations. Fourth, because of the wrapped index calculation, the CUDA kernel computes an erroneous memory pointer that references buffer spaces allocated for a different user's request within the same inference batch. Fifth, the kernel reads or writes data from the adjacent memory space, causing the act_and_mul_kernel to consume or expose another batched user's input or intermediate activation state.\nThe payload behavior and post-exploitation impact manifest as unintended data cross-contamination. A user processing requests in the exact same inference batch receives a partial or complete copy of another user's inference result or hidden states. This compromises the cryptographic and logical isolation boundaries expected between concurrent requests in multi-tenant LLM serving architectures, leading to severe information disclosure risks."
}