Technical impact
NVIDIA Triton Inference Server for Linux has a flaw that allows an attacker to use an expired file descriptor, resulting in an error that can bring the inference service down. The vulnerability is a classic example of CWE‑910, where a reference to an invalid or stale resource causes a crash or hang. The impact is strictly a denial of service; there is no indication of confidentiality or integrity compromise.
Affected Systems
The affected product is NVIDIA Triton Inference Server running on Linux. No specific version information is provided, so all releases that have not yet been updated by NVIDIA are potentially impacted.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% signals that exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog, reducing the assurance that a bad actor has already weaponized it. The attack likely requires that an attacker interacts with the inference service—such as sending a request that triggers file descriptor handling—so it is probably a local or network‑based attack rather than a pure remote code execution vector. A successful exploit would cause the service crash, disrupting availability for users.
