CVE-2026-0481: AMD ROCm Device Metrics Exporter DoS Flaw

CVE-2026-0481 Overview

CVE-2026-0481 is an unrestricted IP address binding vulnerability in the AMD Device Metrics Exporter, a component of the AMD ROCm ecosystem used to expose GPU telemetry. The exporter binds to all available network interfaces by default, allowing remote attackers to reach the management surface without authentication. An attacker with network access can issue requests that modify GPU configuration parameters. Successful exploitation results in loss of GPU availability on affected hosts. The flaw is classified under CWE-1327: Binding to an Unrestricted IP Address.

Critical Impact

Remote, unauthenticated attackers can alter GPU configuration through the exposed Device Metrics Exporter endpoint, disrupting workloads on AMD ROCm-powered GPU compute nodes.

Affected Products

• AMD Device Metrics Exporter (ROCm ecosystem)
• AMD ROCm GPU compute deployments exposing the exporter on networked interfaces
• Kubernetes and container-based GPU clusters using the AMD exporter for metrics scraping

Discovery Timeline

• 2026-05-15 - CVE-2026-0481 published to NVD
• 2026-05-15 - Last updated in NVD database
• 2026-05-15 - AMD publishes Security Bulletin AMD-SB-6031

Technical Details for CVE-2026-0481

Vulnerability Analysis

The AMD Device Metrics Exporter is a service that surfaces GPU telemetry, typically consumed by Prometheus-style scrapers in machine learning and HPC environments. The service is configured to listen on 0.0.0.0, binding to every network interface on the host rather than restricting itself to a loopback or management-only interface. Combined with the absence of authentication on management operations, this design exposes configuration endpoints to any host that can reach the exporter port.

An attacker who can route packets to the GPU host can invoke endpoints that change GPU configuration. Because the targeted system is the GPU workload host itself, configuration manipulation translates directly into degraded or unavailable compute capacity. The CVSS 4.0 vector indicates high availability impact on both the vulnerable and downstream subsequent systems, reflecting the role of GPU nodes in larger training and inference pipelines.

Root Cause

The root cause is an insecure default network binding [CWE-1327]. The exporter listens on all interfaces and does not enforce authentication or authorization on configuration-modifying requests. There is no segmentation between the metrics read path and control-plane operations within the service.

Attack Vector

Exploitation requires only network reachability to the exporter port on a target GPU host. No credentials, user interaction, or prior access are required. In multi-tenant clusters, datacenter networks, or environments where the GPU host is exposed beyond a trusted management network, an attacker can submit crafted requests that alter GPU runtime parameters and force workloads to fail or stall. Refer to AMD Security Bulletin AMD-SB-6031 for vendor technical details.

Detection Methods for CVE-2026-0481

Indicators of Compromise

• Unexpected GPU configuration changes, clock throttling, or device resets logged by rocm-smi or driver telemetry.
• Inbound TCP connections to the AMD Device Metrics Exporter port from hosts outside the metrics-scraping subnet.
• Sudden drops in GPU utilization or training job failures correlated with external network activity to the exporter.

Detection Strategies

• Inventory all hosts running the AMD Device Metrics Exporter and confirm the listening interface using ss -tlnp or netstat.
• Audit firewall and Kubernetes NetworkPolicy rules to identify exporter ports reachable beyond the monitoring namespace.
• Alert on HTTP requests to exporter configuration paths originating from non-Prometheus source IPs.

Monitoring Recommendations

• Forward exporter access logs and GPU driver events into a centralized SIEM or data lake for correlation with network telemetry.
• Baseline normal scraper request patterns and flag deviations in method, path, or source address.
• Monitor for GPU device state transitions that do not correspond to scheduled workload activity.

How to Mitigate CVE-2026-0481

Immediate Actions Required

• Restrict the exporter bind address to 127.0.0.1 or a dedicated management interface and restart the service.
• Apply host-based and network firewall rules limiting exporter port access to authorized monitoring collectors only.
• Review AMD Security Bulletin AMD-SB-6031 and apply the fixed version when available.

Patch Information

AMD has issued guidance in Security Bulletin AMD-SB-6031. Operators should upgrade the Device Metrics Exporter to the version specified by AMD and validate the configuration enforces a restricted bind address by default.

Workarounds

• Place GPU hosts behind a segmented management VLAN and deny exporter traffic from workload or tenant networks.
• In Kubernetes, deploy a NetworkPolicy that only permits Prometheus pods in the monitoring namespace to reach exporter pods.
• Terminate the exporter behind an authenticating reverse proxy that enforces mutual TLS for scrape clients.

# Example: restrict exporter bind address and firewall the port
# 1. Configure exporter to listen on loopback only
--bind-address=127.0.0.1:5000

# 2. Block external access to the exporter port at the host firewall
iptables -A INPUT -p tcp --dport 5000 ! -s 10.0.0.0/24 -j DROP