NVIDIA has disclosed a serious vulnerability affecting its BlueField DPUs and ConnectX networking platforms that could allow attackers to execute code on affected systems if successfully exploited.
This vulnerability, tracked as CVE-2026-65094, impacts the VIRTIO-Net component and has a CVSS v3.1 score of 9.0, indicating a high-risk issue for enterprise and cloud deployments.
According to NVIDIA’s July 2026 security bulletin, the BlueField-3 Virtio-Net implementation contains a CWE-123 write-what-where vulnerability. This allows a malicious actor to manipulate memory by writing arbitrary data to unintended locations.
Such a vulnerability is particularly dangerous because it can be exploited to execute attacker-controlled code, potentially compromising the integrity and confidentiality of the affected systems.
NVIDIA BlueField Vulnerability
The attack scenario involves a virtual machine (VM) user with low privileges crafting a malicious message to trigger the vulnerability. Since the attack vector is adjacent and does not require user interaction, exploitation can occur in shared or multi-tenant environments, such as cloud infrastructures or virtualized data centers.
Additionally, the vulnerability involves a scope change, meaning exploitation could affect resources beyond the initially compromised component, increasing its severity in production environments.
Security researchers note that BlueField DPUs are commonly used to offload networking, storage, and security tasks from host CPUs, making them crucial components in modern data center architectures.
A successful compromise at this layer could enable attackers to bypass traditional security controls, move laterally across workloads, or disrupt network traffic processing.
This heightens the risk for organizations that rely heavily on NVIDIA networking solutions for high-performance computing and cloud-native environments.
The vulnerability affects multiple versions of NVIDIA VIRTIO-Net, including both general availability and long-term support releases.
Specifically, all versions before 25.10.6 for VIRTIO-Net GA, 25.10.2 for LTS25, 24.10.50 for LTS24, and 23.10.23 for LTS23 are affected.
NVIDIA has released patched versions to address the issue and strongly recommends that organizations update immediately to mitigate potential exploitation.
NVIDIA emphasized that its risk assessment is an average across various deployments and may not fully represent the exposure levels of specific environments.
Organizations are advised to evaluate their infrastructure, especially when untrusted virtual machines or tenants may access shared networking resources. The vulnerability was discovered internally by NVIDIA, and as of the disclosure date, no active exploitation has been reported.
However, given the critical nature of write-what-where vulnerabilities and their history of exploitation in real-world attacks, security teams should prioritize addressing this issue.
Users can obtain the latest updates through NVIDIA’s official product security portal and DOCA VIRTIO-Net distribution channels. To reduce the risk of compromise, it is recommended to apply patches, restrict access to untrusted VMs, and monitor for unusual network behavior as part of a layered defense strategy.
