CVE-2026-65115: NVIDIA Infrastructure Controller DoS Vulnerability

CVE-2026-65115 Overview

CVE-2026-65115 affects NVIDIA Infrastructure Controller for Linux. The flaw allows an authenticated network attacker to trigger uncontrolled resource consumption [CWE-400], resulting in denial of service against the controller. The weakness impacts availability only; confidentiality and integrity are not affected according to the published CVSS vector.

NVIDIA published the advisory on September 22, 2026. No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires network access and low privileges, with no user interaction, making the issue reachable from any account able to communicate with the controller service.

Critical Impact
An authenticated attacker on the network can exhaust resources on NVIDIA Infrastructure Controller for Linux, causing denial of service to management operations.

Affected Products

NVIDIA Infrastructure Controller for Linux (specific version list not published in NVD entry)
Refer to the NVIDIA product security advisory for affected version ranges
Linux deployments running the controller service

Discovery Timeline

2026-09-22 - CVE-2026-65115 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65115

Vulnerability Analysis

The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. NVIDIA Infrastructure Controller for Linux fails to constrain resource allocation when processing attacker-supplied input over the network. Successful exploitation degrades or halts the controller's ability to service legitimate requests.

The issue affects availability exclusively. The CVSS vector indicates no impact to data confidentiality or integrity, meaning the attacker cannot read or modify configuration state through this flaw. However, denial of the controller can disrupt orchestration, provisioning, and management workflows that depend on it.

Exploitation requires an authenticated session with low privileges. Environments that grant broad API or management-plane access to standard users face higher exposure. No user interaction is required, and the attack completes within a single security scope.

Root Cause

The root cause is missing or insufficient limits on resource allocation within request handling paths in the Infrastructure Controller. NVIDIA has not disclosed the specific subsystem, but CWE-400 conditions typically arise from unbounded loops, unlimited memory allocation, unrestricted thread or connection creation, or absent rate limiting on expensive operations.

Attack Vector

The attack vector is network-based. An authenticated attacker submits crafted requests to the controller's exposed service endpoints. Repeated or malformed requests consume CPU, memory, file descriptors, or connection slots until the controller becomes unresponsive. Recovery may require service restart or manual intervention.

No verified proof-of-concept code has been published. Technical details are described in prose because no exploit artifacts are available in public sources. Refer to the NVIDIA product security repository for vendor-supplied remediation details.

Detection Methods for CVE-2026-65115

Indicators of Compromise

Sudden spikes in CPU, memory, or file descriptor usage on hosts running NVIDIA Infrastructure Controller for Linux
Unresponsive controller API endpoints or timeouts on management operations
Elevated request rates from a single authenticated identity targeting controller endpoints
Repeated service restarts or out-of-memory events in controller logs

Detection Strategies

Baseline normal request volume and resource utilization for the controller, then alert on statistical deviations
Monitor authentication logs for low-privilege accounts issuing high-volume requests against management APIs
Correlate controller process crashes or restarts with preceding network activity from the same source

Monitoring Recommendations

Enable verbose request logging on the controller and forward events to a centralized SIEM for correlation
Track systemd or process supervisor restart counts for the controller service
Instrument host-level telemetry (CPU, RSS, open file descriptors, socket counts) with alerting thresholds

How to Mitigate CVE-2026-65115

Immediate Actions Required

Apply the vendor patch referenced in the NVIDIA product security advisory as soon as it is available for your version
Restrict network access to the Infrastructure Controller management interface to trusted administrative networks
Audit and reduce the number of low-privilege accounts with API access to the controller
Enable rate limiting at any upstream reverse proxy or API gateway fronting the controller

Patch Information

NVIDIA has published advisory content at the NVIDIA product security repository. Consult the advisory for fixed version numbers and upgrade instructions. Additional metadata is available in the NVD entry for CVE-2026-65115 and the CVE.org record.

Workarounds

Place the controller behind a network access control list that permits only administrative source addresses
Deploy a reverse proxy with connection and request-rate limits in front of the controller API
Segment the management network from general workload traffic to reduce the pool of potential authenticated attackers
Monitor and automatically restart the controller service on resource-exhaustion conditions until patched

bash

# Configuration example: restrict controller access with iptables
iptables -A INPUT -p tcp --dport <controller_port> -s <admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <controller_port> -j DROP