CVE-2026-65112

Executive Summary

CVE-2026-65112 is a resource-exhaustion vulnerability (CWE-400, uncontrolled resource consumption) in the NVIDIA Infrastructure Controller for Linux. A remote attacker who holds low-privileged credentials can trigger a condition that exhausts a system resource, resulting in denial of service against the affected controller. With a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is remotely reachable and requires only low privileges, but is bounded to availability impact only.

Technical Analysis

The vulnerability class is CWE-400, Uncontrolled Resource Consumption. Per the NVD description, the NVIDIA Infrastructure Controller for Linux "contains a vulnerability where an attacker could cause uncontrolled resource consumption," and successful exploitation "might lead to denial of service." CWE-400 is a parent-class weakness covering any condition in which an application fails to properly bound, throttle, release, or garbage-collect a finite resource. Typical resource classes implicated by this weakness include heap or pool memory allocations, file descriptors and sockets, worker threads or connection slots, session/state table entries, and CPU saturation through unbounded request processing.

The public data does not disclose the specific resource that is exhausted, the protocol or request path that triggers the condition, or any code-level construct (function, endpoint, parameter) involved. Accordingly, the following analysis is deliberately limited to what is derivable from the CVSS vector, CWE assignment, and product identification:

• Attack vector (AV:N) — the flaw is exploitable over a network layer, meaning the trigger is reachable remotely rather than requiring local console or physical access. The Infrastructure Controller is a management-plane component, and its network-exposed management interface is the most plausible attack surface consistent with this vector.
• Attack complexity (AC:L) — no race condition, non-default configuration, or significant reconnaissance/obfuscation is required. A straightforward, repeatable request pattern is sufficient.
• Privileges required (PR:L) — the attacker must already possess some authenticated, low-privileged access. This distinguishes the flaw from an unauthenticated flood: it is not a pure volumetric DoS but an authenticated abuse of a resource-consuming operation. An insider, a compromised service account, or a tenant with limited role assignments is sufficient.
• User interaction (UI:N) — no victim action is needed.
• Scope (S:U) — impact is confined to the same security authority as the vulnerable component; the controller itself is the blast boundary, with no demonstrated pivot to other authorities.
• Confidentiality (C:N) and Integrity (I:N) — no data disclosure or modification is claimed.
• Availability (A:H) — the confirmed and sole impact is total loss of availability of the affected component.

Because no patch or advisory text from NVIDIA is available in the tracked sources, the exact allocation site, missing bound, or absent rate-limit cannot be identified. The absence of affected version ranges (Affected Versions: []) and of OSV package mappings means operators must currently assume all deployed versions of the NVIDIA Infrastructure Controller for Linux carry unknown exposure status until NVIDIA publishes a fixed version. There is no evidence of public proof-of-concept code, no Nuclei template, and no observed exploitation in the wild as of this writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-400) and the CVSS profile (network-reachable, low privilege, no user interaction, availability-only).

1. Reconnaissance and target identification. The attacker identifies an exposed NVIDIA Infrastructure Controller for Linux management interface on the network. Discovery would rely on fingerprinting of the controller's web/management surface. The attacker then obtains or is granted low-privileged authenticated access (PR:L) — for example through a legitimate but minimally scoped account, a compromised credential, or a service account with limited role assignments.

2. Triggering the resource-consumption condition. Using the authenticated low-privileged session, the attacker invokes an operation that causes the controller to allocate or retain a resource without an effective upper bound. At the vulnerability-class level this takes the form of repeated, parallel, or cascading requests to a resource-consuming operation — for example large or numerous state-creating requests, unbounded session or job creation, or repeated expensive computations — such that memory, connection slots, file descriptors, thread pools, or session/state table entries are progressively exhausted. No specific endpoint, parameter, or function name is disclosed in the available data, so the precise trigger cannot be enumerated here.

3. Payload/execution method. Exploitation is achieved through normal, well-formed requests over the network to the controller's authenticated interface — no memory-corruption payload, shellcode, or malformed packet is required. The "payload" is volumetric and stateful: the attacker increases request volume, concurrency, or retained state until the targeted resource is depleted.

4. Post-exploitation impact. As the resource pool is exhausted, the controller degrades and eventually becomes unable to service legitimate requests — denial of service (A:H). C/I impact is absent (C:N/I:N), and scope is unchanged (S:U), so the compromise does not extend beyond the vulnerable component's security authority. Secondary operational effects are expected in the environment the controller manages: loss of management-plane visibility and control over the infrastructure it supervises, which can in turn mask other activity or prevent remediation until the controller is restarted or the offending state is cleared.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium). Subscore interpretation:

• AV:N — remotely exploitable across a network boundary, widening the pool of potential sources to any host that can reach the management interface.
• AC:L — reliable, low-effort triggering; no special conditions.
• PR:L — requires authenticated low privilege, which reduces the attacker population to insiders, holders of compromised low-privilege credentials, or tenants with limited roles — but does not eliminate the threat, as such access is frequently the first foothold obtained.
• UI:N — no dependency on a victim user.
• S:U — contained to the vulnerable component's authority.
• C:N / I:N — no confidentiality or integrity loss.
• A:H — complete loss of availability of the affected controller is the characterized outcome.

Business impact: The NVIDIA Infrastructure Controller for Linux is a management/infrastructure component. Denial of service against it can remove operators' ability to monitor, configure, or remediate the systems under its control. Depending on deployment topology, an outage may cascade into loss of observability and delayed incident response for downstream infrastructure.

Blast radius: Bounded to the affected controller and the management functions it provides (S:U). The absence of C/I impact and of scope change argues against lateral movement or data compromise as a direct consequence of this flaw alone. Because affected version ranges are unknown, asset owners cannot currently determine exposure by version and should assume risk for all deployed instances until NVIDIA publishes guidance.

Detection Guidance

Because no specific endpoint, parameter, or protocol detail is published, the following rules are behavioral and must be tuned to the observed interface. They target the CWE-400 exploitation pattern: authenticated low-privileged clients driving abnormal request rates, concurrency, or resource growth against the controller.

Sigma Rule

title: Potential CVE-2026-65112 NVIDIA Infrastructure Controller Resource Exhaustion
id: 3f9c1a72-8b4d-4e10-9c6a-7d2b5e0a1f44
status: experimental
description: Detects repeated authenticated requests or resource-exhaustion behavior against NVIDIA Infrastructure Controller for Linux consistent with CWE-400 abuse.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65112
author: valtersit.com
date: 2026/01/01
tags:
    - attack.t1499
logsource:
    category: web
    product: nvidia_infrastructure_controller
detection:
    selection_status:
        sc-status:
            - 500
            - 503
            - 429
    selection_rate:
        # Tune threshold to baseline; high volume from a single low-privileged principal
        requests_per_minute: 100
    timeframe: 5m
    condition: selection_status and selection_rate
falsepositives:
    - Legitimate administrative bulk operations
    - Monitoring or health-check storms
level: medium

YARA Rule

rule CRITICAL_CVE_2026_65112_Resource_Exhaustion
{
    meta:
        description = "Detects patterns consistent with CWE-400 resource exhaustion against NVIDIA Infrastructure Controller for Linux (CVE-2026-65112)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65112"
        cwe = "CWE-400"
        severity = "medium"

    strings:
        $a = "NVIDIA Infrastructure Controller" ascii nocase
        $b = "resource exhausted" ascii nocase
        $c = "out of memory" ascii nocase
        $d = "too many open files" ascii nocase

    condition:
        uint16(0) == 0x457f or
        any of ($a) and 1 of ($b, $c, $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65112 NVIDIA Infrastructure Controller Resource Exhaustion Attempt"; flow:established,to_server; http.method; content:"GET"; http.header; content:"NVIDIA"; http.response_body; content:"resource exhausted"; nocase; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-65112; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65112; sid:202665112; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method != null ]
  [ network where network.protocol == "http" and http.response.status_code in (429, 500, 503) ]

Splunk SPL Query

index=network sourcetype=web OR sourcetype=proxy
| search ("NVIDIA Infrastructure Controller" OR "Infrastructure Controller")
| eval rc=coalesce(status, sc_status, http_status)
| where rc=429 OR rc=500 OR rc=503
| bin _time span=1m
| stats count AS req_per_min dc(src) AS clients BY src, _time
| where req_per_min > 100
| table _time, src, req_per_min, clients

Wazuh OSSEC Rule

<group name="nvidia_infrastructure_controller,cve-2026-65112,resource_exhaustion,">
  <rule id="100651" level="10">
    <decoded_as>json</decoded_as>
    <field name="status">429|500|503</field>
    <field name="product">NVIDIA Infrastructure Controller</field>
    <description>CVE-2026-65112: Repeated resource-exhaustion responses from NVIDIA Infrastructure Controller - possible denial of service.</description>
    <group>dos,cve_2026_65112,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, advisory text, or affected version range has been published in tracked sources. No public workaround is documented.

1. Immediate mitigations

   • Restrict network access to the NVIDIA Infrastructure Controller management interface to trusted management networks and jump hosts; the CVSS vector AV:N means reachability should be minimized as a first-order control.
   • Enforce least privilege and aggressive role minimization for accounts on the controller, directly countering the PR:L requirement; audit for dormant, shared, or overly broad service accounts.
   • Apply rate limiting, connection caps, and concurrent-request throttling at the reverse proxy or load balancer that fronts the controller, so that even an authenticated low-privileged principal cannot drive unbounded request or state growth.
   • Deploy resource monitoring and alerting (memory, file descriptors, thread pools, connection counts, session/state table growth) on the controller host so exhaustion is detected before full DoS.
   • Configure automated restart/quarantine or circuit-breaker behavior for the controller to bound outage duration, and ensure the controller is not a single point of failure for critical infrastructure functions.

2. Patch/upgrade steps

   • Monitor NVIDIA's official security advisory channel (NVIDIA Product Security) and the NVD entry for CVE-2026-65112 for a fixed version. Because patch confidence is 0/4 and no vendor fix is identified, no upgrade target can be specified at this time.
   • Establish a controlled update process now so a fixed release can be validated and deployed rapidly upon publication; maintain an inventory of every deployed NVIDIA Infrastructure Controller for Linux instance, since affected version ranges are unknown.

3. Long-term hardening

   • Adopt a Zero Trust posture around management-plane components: strong authentication, per-account authorization, and continuous validation of every request rather than implicit trust of authenticated sessions.
   • Instrument the controller with resource-consumption baselines and anomaly detection oriented at CWE-400 behavior (steady growth in retained state with no corresponding legitimate workload).
   • Track CWE-400-class vulnerabilities in infrastructure management products as a procurement and risk-register item; require vendors to publish CVE, affected ranges, and fixed versions.
   • Maintain and rehearse a management-plane denial-of-service runbook covering isolation, restart, credential rotation, and forensic capture.

References

• NVD — CVE-2026-65112: https://nvd.nist.gov/vuln/detail/CVE-2026-65112
• MITRE CWE-400, Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499, Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS: not yet scored for this CVE — no EPSS value available (https://www.first.org/epss/)
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-65112 is NOT listed as of this writing (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
• NVIDIA Product Security incident response and advisory channel (no advisory for this CVE available in tracked sources at time of writing): https://www.nvidia.com/en-us/security/

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation has been observed for CVE-2026-65112. No threat actor campaign has been associated with this CVE in available data.