A high-severity memory disclosure flaw tracked as CVE-2026-73558 (CVSS score 8.6) in the high-throughput vLLM inference engine allows malicious tenants on shared GPU clusters to leak inference prompts and model completions from other concurrent users. The flaw stems from an integer overflow within custom CUDA PagedAttention kernels.

Executive Overview: Multi-Tenant LLM Serving at Risk

vLLM is the industry standard open-source library for high-performance LLM serving, powering production inference clusters across major cloud providers, private AI clouds, and enterprise SaaS offerings. Its signature architectural innovation—PagedAttention—manages attention key-value (KV) memory similarly to virtual memory in operating systems, virtually eliminating memory fragmentation and boosting throughput up to 24x over standard PyTorch serving.

However, researcher audits revealed a fundamental boundary flaw in the custom CUDA kernel responsible for sequence offset calculations. Under sustained high-load batched inference, malicious or crafted input sequences trigger an arithmetic overflow, causing GPU kernel execution threads to index out-of-bounds KV cache physical blocks belonging to adjacent client sessions.

Technical Deep-Dive: The PagedAttention Indexing Bug

In vLLM's memory allocation model, KV cache tokens are stored in non-contiguous physical memory blocks allocated across High Bandwidth Memory (HBM). During decoding and prefill phases, custom CUDA kernels translate logical token positions into physical block table indices.

In affected versions of csrc/attention/attention_kernels.cu, the memory stride indexing calculation utilized signed 32-bit integers (int32_t) for cumulative context length offsets: 

// Vulnerable CUDA kernel stride calculation in attention_kernels.cu
__global__ void paged_attention_v1_kernel(
    scalar_t* __restrict__ out,
    const scalar_t* __restrict__ q,
    const scalar_t* __restrict__ k_cache,
    const scalar_t* __restrict__ v_cache,
    const int32_t* __restrict__ block_tables,
    const int32_t* __restrict__ context_lens,
    const int32_t max_num_blocks_per_seq) {
    
    // Arithmetic overflow occurs when batch token stride exceeds 2^31 - 1 elements
    int32_t seq_idx = blockIdx.y;
    int32_t cur_context_len = context_lens[seq_idx];
    int32_t kv_offset = (seq_idx * max_num_blocks_per_seq + block_idx) * block_size;
    // kv_offset wraps to negative or improper boundary, indexing adjacent tenant memory
}

When an adversary submits sequences calibrated with extreme padding tokens alongside high batch sizes, kv_offset overflows. Instead of throwing an exception or clamping to valid memory ranges, the CUDA kernel reads data from unallocated or concurrently allocated physical KV cache blocks assigned to other tenants on the same GPU.

Impact & Exploitation Vectors

In a multi-tenant cloud environment, such as an AI API gateway serving multiple corporate customers from the same GPU pool:

  • Cross-Tenant Prompt Snooping: An attacker can repeatedly query the inference endpoint with trigger sequence lengths, capturing fragments of proprietary prompts, API tokens, and confidential corporate communications submitted simultaneously by other users.
  • Inference Output Contamination: In addition to reading prompt data, corrupted attention matrices can lead to cross-tenant response pollution, where fragments of confidential documents are echoed into the attacker's output stream.

Vulnerability Profile & Specifications

Parameter Vulnerability Metric
Vulnerability ID CVE-2026-73558 / GHSA-482f-799m-1123
Common Weakness CWE-190: Integer Overflow or Wraparound
CVSS v3.1 Score 8.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Affected Releases vLLM versions 0.4.0 through 0.6.3
Patched Version vLLM v0.6.4
Hardware Target NVIDIA Ampere, Hopper, and Blackwell GPU architectures running CUDA 12+

Remediation & Hardening Guidelines

AI platform engineers and cluster operators must immediately roll out the official vLLM patch and enforce container-level isolation:

1. Upgrade vLLM Dependency

# Upgrade vLLM to patched release 0.6.4
pip install --upgrade vllm>=0.6.4

# Verify installed package version
python3 -c "import vllm; print(vllm.__version__)"

2. Deploy Tenant-Isolated GPU Workloads

Until patches are verified, multi-tenant AI operators should disable token batching across untrusted tenants. Utilize Kubernetes NVIDIA Multi-Instance GPU (MIG) partitioning or dedicate distinct GPU instances per tenant to prevent shared physical HBM allocation. 

# Configure MIG slice for hardware-enforced tenant boundaries
nvidia-smi mig -cgi 19,19,19 -C