CVE-2026-24226: NVIDIA TensorRT-LLM RCE Vulnerability

CVE-2026-24226 Overview

CVE-2026-24226 affects NVIDIA TensorRT-LLM for Linux, a large language model inference optimization library. The vulnerability stems from improper control of code generation, categorized under [CWE-829] Inclusion of Functionality from Untrusted Control Sphere. An attacker with local access and high privileges can exploit this flaw to influence how code is generated or loaded by the framework. Successful exploitation may lead to code execution, data tampering, and information disclosure within the affected TensorRT-LLM environment.

Critical Impact
Exploitation can result in arbitrary code execution, integrity compromise of model inference workloads, and disclosure of sensitive data processed by TensorRT-LLM.

Affected Products

NVIDIA TensorRT-LLM for Linux
LLM inference workloads relying on TensorRT-LLM code generation components
GPU-accelerated AI/ML pipelines integrating TensorRT-LLM on Linux hosts

Discovery Timeline

2026-07-14 - CVE-2026-24226 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-24226

Vulnerability Analysis

CVE-2026-24226 resides in the code generation pathway of NVIDIA TensorRT-LLM on Linux. The framework compiles and optimizes model graphs into executable kernels, and this process can incorporate content sourced from files or configuration inputs. When those inputs are not adequately validated, an attacker can influence what code is produced or loaded during runtime.

The issue is classified under [CWE-829], which covers inclusion of functionality from an untrusted control sphere. In practical terms, a local attacker who can stage crafted model artifacts, configuration files, or plugin components can steer the generation process toward attacker-controlled logic. The result is code execution in the context of the TensorRT-LLM process, integrity loss for model outputs, and exposure of data resident in the inference pipeline.

Root Cause

The root cause is insufficient control over which components or inputs the TensorRT-LLM code generation stage trusts. Rather than restricting sources to validated, first-party artifacts, the process consumes external content that can be manipulated by a privileged local actor. This weakens the trust boundary between the framework and user-supplied data.

Attack Vector

Exploitation requires local access, high privileges, and user interaction. The attack complexity is high, indicating that specific preconditions or timing must align for the exploit to succeed. An attacker satisfying these conditions can plant malicious model files, plugins, or configuration data that the TensorRT-LLM code generation stage subsequently ingests, causing execution of attacker-controlled code with the privileges of the inference process. The EPSS score at publication was approximately 0.119%, reflecting a low near-term probability of opportunistic exploitation.

No public proof-of-concept exploit code has been released. The vulnerability mechanism is documented in the NVD CVE-2026-24226 Detail and the CVE.org Record for CVE-2026-24226.

Detection Methods for CVE-2026-24226

Indicators of Compromise

Unexpected modifications to TensorRT-LLM model artifacts, plugin binaries, or configuration files on Linux inference hosts.
Spawning of unusual child processes or shell invocations from the TensorRT-LLM inference process.
Outbound network connections initiated by inference workloads that historically operate in isolated environments.

Detection Strategies

Monitor filesystem write events targeting TensorRT-LLM installation directories, plugin paths, and model cache locations.
Baseline the expected process tree of TensorRT-LLM workloads and alert on deviations such as new interpreter or compiler invocations.
Correlate privileged local logons on GPU inference hosts with subsequent modifications to AI pipeline artifacts.

Monitoring Recommendations

Enable audit logging (auditd) on directories that host TensorRT-LLM binaries, models, and plugin libraries.
Track loading of unsigned or unexpected shared objects into inference processes using tools such as ldd inventories and runtime LD_PRELOAD checks.
Forward host telemetry from AI/ML nodes into a centralized analytics platform to enable retroactive hunting once additional indicators emerge.

How to Mitigate CVE-2026-24226

Immediate Actions Required

Restrict administrative and high-privilege access on Linux hosts running TensorRT-LLM to a minimal set of trusted operators.
Validate the integrity of model files, plugins, and configuration artifacts against known-good hashes before loading them into TensorRT-LLM.
Isolate inference hosts from general-purpose workloads and enforce strict egress controls to limit post-exploitation impact.

Patch Information

Refer to the NVD CVE-2026-24226 Detail and NVIDIA's official product security advisories for the fixed TensorRT-LLM release. Apply the vendor-supplied update to all affected Linux inference hosts. Rebuild any downstream container images that bundle TensorRT-LLM so that patched binaries propagate throughout the AI/ML supply chain.

Workarounds

Restrict write access to TensorRT-LLM installation directories and model repositories to a dedicated service account.
Load only signed and internally reviewed models and plugins; block ingestion of artifacts from untrusted third-party sources.
Run TensorRT-LLM workloads inside hardened containers with mandatory access controls such as SELinux or AppArmor to constrain code execution scope.

bash

# Configuration example: restrict permissions on TensorRT-LLM directories
sudo chown -R trtllm:trtllm /opt/tensorrt-llm
sudo chmod -R 750 /opt/tensorrt-llm
sudo find /opt/tensorrt-llm -type f -name '*.so' -exec chmod 550 {} \;

# Enable auditd monitoring on model and plugin directories
sudo auditctl -w /opt/tensorrt-llm -p wa -k trtllm_integrity