Executive brief
A vulnerability in the PyTorch machine learning library can cause applications to crash or stop responding. This occurs when the performance profiling tool is used but not properly shut down, leading to a denial-of-service condition. This could disrupt AI model training or inference tasks, potentially impacting operational uptime for developers and researchers.
Technical details
A vulnerability classified as Improper Locking (CWE-667) exists in PyTorch v2.5 and v2.7.1 within the torch.profiler.profile (PythonTracer) component. The root cause is the omission of the profiler.stop() call, which can cause the application to crash (segmentation fault) or hang during the finalization process. An attacker with local access and the ability to execute code using the affected library can trigger this condition to cause a Denial of Service (DoS). The issue is documented in PyTorch GitHub issue #156563.
Affected products
- Linux Foundation PyTorch 2.5, 2.7.1
Timeline
- 2025-11-12: disclosed
- 2025-11-12: advisory