NVIDIA Dynamo for Linux contains a race condition in the LoRA manager singleton initialization. This flaw allows an attacker to trigger concurrent initialization attempts, potentially causing the service to crash or become corrupted. The consequence is loss of availability and the possibility of data tampering, as the Manager may become inconsistently updated or corrupted during the race.

The vulnerability affects NVIDIA Dynamo running on Linux platforms. No specific version numbers are provided in the CVE data, so any instance of Dynamo that has not been patched or updated after the disclosure is considered at risk.

The CVSS score of 6.5 places this vulnerability in the medium severity range. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting a lower probability of active exploitation. The attack likely requires local or privileged access to the Dynamo process, as the race condition occurs during internal initialization. Without a remote exploitation vector, the risk is confined to environments where the attacker can influence the execution of Dynamo or its configuration.