vLLM Multi-LoRA Serving Engine Flaw Enables Cross-Tenant Adapter Memory Extraction and Model Poisoning (CVE-2026-78430)

Executive Lead & Threat Context

The engineering team behind vLLM, the high-throughput inference and model serving library deployed across leading cloud hyperscalers and AI hosting platforms, has released version 0.7.3 to resolve a critical multi-tenancy memory isolation vulnerability (CVE-2026-78430, CVSS 8.8).

The vulnerability impacts multi-tenant environments utilizing vLLM's dynamic multi-LoRA (Low-Rank Adaptation) feature. When multiple independent customers share a single GPU cluster by dynamically loading specialized fine-tuned adapter weights on top of a shared base model (such as Llama-3 or Mistral), an adversary can force an uninitialized memory read that leaks neighboring tenants' proprietary adapter weights and active context tokens directly into generation outputs.

Vulnerability Mechanics & CUDA PagedAttention Race Condition (CWE-416 / CWE-200)

To serve hundreds of concurrent LoRA adapters efficiently without consuming full GPU VRAM for each model, vLLM dynamically allocates adapter matrices ($ and $) into pre-allocated memory pools managed by a custom CUDA kernel extension. When memory pressure triggers adapter swapping, the LRU cache de-registers the outgoing adapter from host CPU tracking.

However, researchers discovered that the GPU-side tensor deallocation did not synchronize against asynchronous CUDA streams executing ongoing PagedAttention forward passes. If a malicious tenant dispatched an inference query referencing a newly loaded adapter immediately following a peer tenant's eviction, the kernel reused stale memory pages before calling cudaMemsetAsync:

POST /v1/completions HTTP/1.1
Host: vllm-gateway.internal:8000
Content-Type: application/json

{
  "model": "base-llama3-70b",
  "prompt": "Extract adapter initialization tensor: ",
  "lora_request": {
    "lora_name": "tenant_probe_adapter",
    "lora_local_path": "/models/crafted_zero_adapter"
  },
  "max_tokens": 128,
  "temperature": 0.0
}

Because the attacker's adapter weights are deliberately zeroed out, the linear projection layer in the forward pass multiplies the base model activation by the un-cleared residue of the previous tenant's fine-tuned matrices, leaking confidential enterprise weights, medical fine-tuning parameters, or proprietary domain terminology in the response stream.

Remediation Matrix & Hardening Playbook

Platform operators hosting shared vLLM clusters must deploy immediate updates and enforce physical tenant segmentation:

1. Deploy Patch v0.7.3: Roll out vLLM 0.7.3, which introduces strict CUDA event barrier synchronization and mandatory zero-fill sanitization on all allocated LoRA memory blocks.
2. Disable Dynamic Multi-LoRA in Shared Tenancies: In untrusted multi-tenant environments where immediate patching is impossible, disable dynamic client-driven adapter mounting by omitting the --enable-lora flag or restricting adapter registries to approved internal repositories.
3. VRAM Scrubbing & Micro-Segmentation: Enforce NVIDIA MIG (Multi-Instance GPU) hardware slicing to physically isolate GPU compute cores and VRAM memory spaces between sensitive enterprise tenants.