Description
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PyTorch | 2.6.0+cu124 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pytorch | No fix yet | — |
| Debian 13 | pytorch | No fix yet | — |
| Debian 12 | pytorch | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pytorch | No fix yet | — |
| Ubuntu 26.04 LTS | pytorch | No fix yet | — |
| Ubuntu 25.10 | pytorch | No fix yet | — |
| Ubuntu 22.04 LTS | pytorch | No fix yet | — |
Advisories 2
- WID-SEC-2026-1396 HCL BigFix Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 20, 2026
- WID-SEC-2025-0941 PyTorch: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 5, 2025
References
- VDB-307394 | PyTorch nccl.py torch.cuda.nccl.reduce denial of service vdb-entry technical-description
- VDB-307394 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #553644 | pytorch pytorch (in torch.cuda.nccl.reduce) 2.6.0 Denial of Service third-party-advisory
- https://github.com/pytorch/pytorch/issues/150836 issue-tracking
- https://github.com/pytorch/pytorch/pull/150923 issue-tracking
- https://github.com/pytorch/pytorch/issues/150836#issue-2979097872 exploit issue-tracking
- https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5 patch