CVE-2026-87083: tile-ai tilelang Deserialization RCE Vulnerability

CVE-2026-87083 Overview

CVE-2026-87083 is an insecure deserialization vulnerability in tile-ai tilelang versions up to 0.1.14. The flaw resides in the KernelCache._load_kernel_from_disk function in tilelang/cache/kernel_cache.py. The component loads cached kernel parameters using cloudpickle, which deserializes arbitrary Python objects and can execute attacker-controlled code. An attacker who can influence the on-disk kernel cache can trigger deserialization of malicious payloads when the cache is loaded. The vulnerability is tracked under CWE-20: Improper Input Validation and is addressed by commit 11ec2397fe942e8b422d026af4a03d6e0a55ae6c.

Critical Impact
Loading a poisoned kernel cache file allows arbitrary Python code execution in the context of the tilelang process, compromising the machine learning compilation pipeline.

Affected Products

tile-ai tilelang versions up to and including 0.1.14
The KernelCache component in tilelang/cache/kernel_cache.py
The autotuner parameter store in tilelang/autotuner/param.py

Discovery Timeline

2026-09-09 - CVE-2026-87083 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87083

Vulnerability Analysis

tilelang caches compiled kernels and their parameters to disk to accelerate subsequent runs. The KernelCache._load_kernel_from_disk routine reconstructed cached KernelParam objects by calling cloudpickle.load on files stored in the cache directory. cloudpickle is an extension of Python's pickle protocol and executes any __reduce__ methods defined on the serialized objects. An attacker who writes or replaces a cache file can therefore execute arbitrary Python code the next time tilelang loads that entry.

The attack surface expands in shared environments such as multi-tenant GPU clusters, CI pipelines, or systems that pull cached kernels from remote storage. Any code path that populates the cache directory becomes a code-execution primitive against downstream consumers.

Root Cause

The root cause is the use of an unsafe serialization format for on-disk state. cloudpickle was chosen for its ability to serialize complex Python objects, but it provides no integrity or authenticity guarantees and executes arbitrary constructors during load. The kernel cache did not validate the origin, structure, or signature of cached parameter files prior to deserialization.

Attack Vector

Exploitation requires the attacker to place a crafted cache file in a location that tilelang will read, and requires a user or automated job to invoke a code path that triggers _load_kernel_from_disk. Delivery vectors include shared filesystems, tampered container images, hostile package artifacts, and remote model or kernel repositories.

python

# Patch: tilelang/cache/kernel_cache.py
 from typing import Literal
 from collections.abc import Callable
 
-import cloudpickle
 from tvm.target import Target
 from tvm.tirx import PrimFunc
 from tvm.runtime import Executable
 from tilelang.backend.module import BackendContext, create_backend_context
-from tilelang.engine.param import KernelParam
+from tilelang.engine.param import KernelParam, dump_kernel_params, load_kernel_params
 from tilelang.utils.language import get_prim_func_name
 from tilelang import env
 from tilelang.jit import JITKernel

Source: GitHub commit 11ec239. The fix removes cloudpickle from the cache load path and replaces it with structured JSON serialization via dump_kernel_params and load_kernel_params.

Detection Methods for CVE-2026-87083

Indicators of Compromise

Unexpected .pkl or cloudpickle artifacts appearing in the tilelang cache directory outside normal build activity.
Child processes spawned from Python interpreters loading tilelang kernels, especially shells or network utilities.
Modifications to cache files performed by user or service accounts that do not normally compile kernels.

Detection Strategies

Inspect the tilelang cache directory for files whose byte signature matches pickle opcodes (\\x80\\x04 and similar) after upgrading to the JSON-based format.
Enable Python audit hooks (sys.addaudithook) to log calls to pickle.load and cloudpickle.load originating from tilelang modules.
Correlate process ancestry: alert when the tilelang or autotuner process forks non-Python children during cache load operations.

Monitoring Recommendations

Monitor filesystem writes to tilelang cache paths and flag writes from non-build identities.
Track outbound network connections from workloads that run tilelang compilation, since deserialization payloads frequently trigger callbacks.
Log tilelang version strings across GPU and ML build hosts to identify systems still running versions at or below 0.1.14.

How to Mitigate CVE-2026-87083

Immediate Actions Required

Inventory all systems running tile-ai tilelang and identify installations at or below version 0.1.14.
Apply commit 11ec2397fe942e8b422d026af4a03d6e0a55ae6c from the tilelang repository or build from a branch that includes PR #3143.
Purge existing kernel cache directories so that tilelang regenerates entries using the JSON format.

Patch Information

The upstream fix is commit 11ec2397fe942e8b422d026af4a03d6e0a55ae6c, delivered through Pull Request #3143, which stores cached kernel parameters as JSON instead of cloudpickle. Per the advisory in VulDB CVE-2026-87083, the fix has not yet been included in an official release, so users must apply the patch directly from source. See GitHub Issue #2817 for background.

Workarounds

Restrict write access to the tilelang cache directory to a single trusted build identity using filesystem ACLs.
Disable or bypass the disk cache in untrusted or multi-tenant environments until the patched code is deployed.
Isolate tilelang compilation in ephemeral containers with no persistent shared cache and no outbound network egress.

bash

# Restrict tilelang cache to the build service account and remove untrusted entries
CACHE_DIR="${TILELANG_CACHE_DIR:-$HOME/.tilelang/cache}"
chown -R builder:builder "$CACHE_DIR"
chmod -R 700 "$CACHE_DIR"
find "$CACHE_DIR" -type f \( -name '*.pkl' -o -name '*.cloudpickle' \) -delete