Executive brief
vLLM is a widely-used open-source inference engine that powers large language model deployments. An integer overflow bug in the GPU activation kernel can cause one user's AI model output to be accidentally included in another user's response when multiple requests are processed together in the same batch. An attacker can deliberately craft requests to trigger this condition and steal sensitive information from other users' AI interactions.
Technical details
The vulnerability is an integer overflow in the expression "blockIdx.x * 2 * d" within the act_and_mul_kernel GPU kernel (csrc/activation_kernels.cu line 82). When the intermediate computation exceeds 2^32 and wraps around to a small value (particularly when 2^32 is divisible by d, the hidden dimension size), the kernel can compute memory addresses that read from another user's input buffer instead of the current user's. This results in User A's output buffer receiving partial or complete copies of User B's inference result. The vulnerability is straightforward to trigger: using batch size 17, sequence length 16384, and d=8192 (as in Llama-3.2-1B-Instruct) causes the final batch response to be an exact copy of the first. Network-reachable vLLM services accepting multiple concurrent inference requests are vulnerable. No privilege or special user interaction is required beyond submitting crafted inference requests. The fix was released in vLLM version 0.27.0.
Affected products
- vLLM Project vLLM < 0.27.0
Timeline
- 2026-08-11: disclosed: Published to GitHub Security Advisory
- 2026-09-08: patched: Fix released in vLLM v0.27.0