Executive brief
vLLM is an engine used to run and serve Large Language Models (LLMs). A flaw in how it handles very large data structures (tensors) can cause it to return uninitialized memory from the graphics processor (GPU). In environments where multiple users share the same hardware, this could allow one user to accidentally or intentionally see fragments of data belonging to another user's previous requests.
Technical details
An integer truncation vulnerability exists in vLLM's GGUF dequantize kernels (specifically within csrc/quantization/gguf/gguf_kernel.cu). The 'to_cuda_ggml_t' function pointer typedef incorrectly declares its element count parameter 'k' as a 32-bit integer. When processing large GGUF models where tensor dimensions (m * n) exceed INT_MAX, the value is truncated. Because output tensors are allocated using 'torch::empty', which does not initialize memory, the CUDA kernel only processes the truncated number of elements, leaving the remainder of the tensor populated with stale GPU memory. In multi-tenant deployments, this residual memory may contain sensitive data from other users' inference requests. The fix involves widening the parameter to int64_t and zero-initializing output tensors as a defense-in-depth measure.
Affected products
- vLLM Project vLLM >= 0.5.5, < 0.23.1rc0
Timeline
- 2026-06-09: disclosed: Vulnerability reported to maintainers
- 2026-06-11: patched: Fix merged into main branch
- 2026-06-22: advisory: NVD and GitHub Security Advisory published