CVE-2026-65131: NVIDIA NVSentinel DOS Vulnerability

CVE-2026-65131 Overview

CVE-2026-65131 affects NVIDIA NVSentinel for Linux. The vulnerability resides in the platform-connectors component, which exposes a gRPC health-event interface over a world-writable Unix domain socket. The interface lacks authentication, allowing local users with access to the socket to send unauthenticated requests. A successful exploit can trigger a denial of service in the affected component.

The weakness is classified as Missing Authentication for Critical Function [CWE-306]. Exploitation requires local access with high privileges but no user interaction, and the impact crosses a trust boundary, resulting in a scope change.

Critical Impact
Local attackers with socket access can disrupt NVSentinel health-event processing, causing denial of service to monitored platform workloads.

Affected Products

NVIDIA NVSentinel for Linux (platform-connectors component)

Discovery Timeline

2026-10-13 - CVE-2026-65131 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-65131

Vulnerability Analysis

NVSentinel exposes a gRPC endpoint for health-event telemetry through a Unix domain socket. The socket permissions are world-writable, meaning any local account on the host can connect to it. The service does not require clients to authenticate before invoking gRPC methods on the health-event interface.

An attacker with a local shell can craft gRPC requests that disrupt the service, exhaust resources, or otherwise force the component into an unavailable state. Because the vulnerable interface runs with higher privileges than the calling user, exploitation produces a scope change: a lower-privileged local caller affects a higher-privileged component. The resulting impact is availability loss only; the advisory does not identify confidentiality or integrity consequences.

Root Cause

The root cause combines two design flaws. First, the Unix domain socket is created with permissive, world-writable mode bits instead of restricting access through filesystem ACLs or socket ownership. Second, the gRPC server behind the socket does not enforce peer credential checks or mutual TLS. The combination allows unauthenticated local invocation of a privileged interface, which maps directly to [CWE-306] Missing Authentication for Critical Function.

Attack Vector

Exploitation is local. An attacker needs an existing account on the host where NVSentinel runs and the ability to open the world-writable Unix socket exposed by platform-connectors. The attacker then issues gRPC calls to the health-event interface without presenting credentials. There is no network-facing exposure and no user interaction required.

See the NVIDIA Product Security advisory for vendor-provided technical details.

Detection Methods for CVE-2026-65131

Indicators of Compromise

Unexpected gRPC connections to the NVSentinel platform-connectors Unix domain socket from non-service accounts.
Abnormal termination, restart loops, or health-check failures of the NVSentinel service process.
Gaps in NVSentinel health-event telemetry for monitored platform components.

Detection Strategies

Audit the mode and ownership of the NVSentinel Unix domain socket on each host; alert when permissions are world-writable (0666 or broader).
Enable Linux audit (auditd) rules on the socket path to log connect() syscalls from unexpected UIDs.
Correlate service crash events for NVSentinel with recent local shell activity or new process executions.

Monitoring Recommendations

Forward NVSentinel service logs and host audit logs to a central analytics platform for correlation.
Track process restart counts and uptime metrics for platform-connectors as service-health signals.
Monitor local privilege boundaries by baselining which accounts normally access the NVSentinel socket.

How to Mitigate CVE-2026-65131

Immediate Actions Required

Apply the NVIDIA security update referenced in the NVIDIA Product Security advisory as soon as it is available for your platform.
Restrict interactive and service account access on hosts running NVSentinel to trusted administrators only.
Inventory all hosts running the platform-connectors component and prioritize patching based on exposure.

Patch Information

NVIDIA tracks the fix under advisory 2026/5890. Review the NVIDIA Product Security advisory for the fixed version and upgrade instructions. Reference records are available on the NVD entry for CVE-2026-65131 and the CVE.org record.

Workarounds

Tighten permissions on the NVSentinel Unix domain socket so that only the service account and authorized administrators can connect.
Place the socket in a directory with restrictive mode bits (for example, 0750) owned by the NVSentinel service user and group.
Limit local login on affected hosts and remove unnecessary shell accounts to reduce the pool of potential attackers.

bash

# Configuration example: restrict access to the NVSentinel socket directory
sudo chown nvsentinel:nvsentinel /var/run/nvsentinel
sudo chmod 0750 /var/run/nvsentinel
sudo find /var/run/nvsentinel -type s -exec chmod 0660 {} \;