CVE-2025-4287

NameCVE-2025-4287
DescriptionA vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1104931

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pytorch (PTS)bullseye1.7.1-7vulnerable
bookworm1.13.1+dfsg-4vulnerable
sid, trixie2.6.0+dfsg-7vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pytorchsource(unstable)(unfixed)1104931

Notes

[bookworm] - pytorch <no-dsa> (Minor issue)
https://github.com/pytorch/pytorch/issues/150836
https://github.com/pytorch/pytorch/pull/150923

Search for package or bug name: Reporting problems