CVE-2026-65115

Executive Summary

CVE-2026-65115 is a denial-of-service vulnerability in the NVIDIA Infrastructure Controller for Linux, caused by uncontrolled resource consumption (CWE-400). An authenticated attacker with network access can exploit this flaw to exhaust system resources, rendering the affected controller unavailable. With no patch currently available and no public exploit code, the vulnerability represents a latent availability risk for organizations running the affected NVIDIA product in their infrastructure.

Technical Analysis

The vulnerability resides in the NVIDIA Infrastructure Controller for Linux and is classified under CWE-400 (Uncontrolled Resource Consumption). According to the NVD description, an attacker "may cause uncontrolled resource consumption," and a successful exploit "may lead to denial of service."

At the vulnerability-class level, CWE-400 denotes that the product fails to properly control the allocation and release of a limited resource — such as memory, file descriptors, threads, or network connections — when handling attacker-influenced input. The specific resource exhausted, the exact interface exposed, and the code path involved are not disclosed in the CNA title or NVD description. No function names, class names, file paths, endpoint definitions, or parameter names are provided in the supplied intelligence data, and none are asserted here.

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reveals several important properties of the attack surface:

• Network vector (AV:N): The flaw is remotely reachable; the attacker does not require local or adjacent access to the controller instance.
• Low attack complexity (AC:L): No special conditions, race windows, or unusual configurations are needed. Exploitation is repeatable and straightforward for a capable attacker.
• Low privileges required (PR:L): The attacker must possess some level of authenticated access. This is NOT a pre-authentication vulnerability — an anonymous or unauthenticated remote attacker cannot directly trigger it. The attacker must first hold a valid low-privileged account on the controller.
• No user interaction (UI:N): No victim must click a link or open a file; the exploit proceeds autonomously once the request is delivered.
• Scope unchanged (S:U): The resource exhaustion remains confined to the vulnerable component's security authority; exploited impact does not directly cross into other security scopes.
• Confidentiality and Integrity impact: None (C:N/I:N): The vulnerability does not expose or alter data — it is purely an availability defect.
• Availability impact: High (A:H): Successful exploitation fully degrades or halts the service.

Because the controller is an infrastructure-management component rather than an end-user application, availability loss can propagate: managed nodes or downstream orchestration functions that depend on the controller may become unreachable or unmanageable while the service is down.

No CVSS temporal or environmental modifiers are published, and no EPSS score has been assigned by FIRST.org at the time of writing. There is no evidence of exploit-in-the-wild activity, and CVE-2026-65115 has not been added to CISA's Known Exploited Vulnerabilities catalog.

Exploitation Scenarios

No public proof-of-concept code, Metasploit module, or Nuclei template exists for CVE-2026-65115. The attack chain below is therefore inferred strictly from the vulnerability class (CWE-400) and the CVSS vector; no specific endpoints, parameters, or code constructs are fabricated.

1) Reconnaissance / target identification The attacker identifies a reachable NVIDIA Infrastructure Controller for Linux instance. Since CVSS indicates AV:N, the controller's listening service is exposed over the network. Discovery may occur through internal network scanning, asset inventory leaks, or Shodan-style internet queries matching the product's HTTP banner or management page. The attacker must confirm the product and version, because exploitation requires the target to be an affected build.

2) Obtaining the required privilege level Because PR:L applies, the attacker must first acquire a low-privileged authenticated session on the controller. This could be achieved through legitimate but weak credentials, a previously compromised credential, or a separate vulnerability that grants low-privileged access. The vulnerability itself does not provide authentication bypass — the attacker arrives with a valid low-privilege identity.

3) Triggering uncontrolled resource consumption With network access and a low-privileged session, the attacker sends requests to the controller that cause it to allocate or retain a limited resource without appropriate bounds or release. Depending on the specific resource affected (allocation is not specified in the available data), the attacker repeats the operation — or issues a small number of crafted requests — until the controller can no longer service legitimate requests. Because AC:L applies, no complex timing or special state is required; the operation reliably consumes the resource. The precise resource (memory, connection table, worker pool, etc.) and the exact request format are not disclosed in the vendor description and must not be assumed.

4) Post-exploitation impact The primary outcome is denial of service (A:H): the Infrastructure Controller becomes unavailable, and dependent infrastructure — managed nodes, orchestration workflows, or administrative dashboards — loses its management plane. C:N and I:N confirm no data theft or tampering is a direct consequence of this flaw alone. An attacker could combine the DoS with other activity (for example, forcing failover, masking a concurrent intrusion, or applying operational pressure), but such chaining is speculative and not supported by the vulnerability data.

Because no exploit code is public, real-world exploitation would currently require an attacker to reverse-engineer the controller's interface — a modest but real barrier.

Impact Assessment

The CVSS base score is 6.5 (Medium), driven entirely by the availability subscore. The confidentiality and integrity subscores are None, meaning the flaw does not directly leak or modify data. The High availability impact means exploited systems lose core functionality — the controller stops providing its management service.

Blast radius depends on deployment topology. An NVIDIA Infrastructure Controller for Linux typically serves as a control point for managed infrastructure. If the controller is a single instance with no redundancy, a successful DoS can take an entire managed fleet offline from an administrative perspective, delaying incident response, patching, and workload orchestration. If redundancy or failover exists, the attacker may need to exhaust resources across multiple instances, raising the attack cost but not eliminating the risk.

The Low privileges requirement (PR:L) narrows the attacker population to those holding valid low-privileged credentials — for example, an insider, a contractor with limited access, or an external attacker who has already harvested credentials. This lowers the likelihood relative to a pre-auth DoS but does not reduce the consequence once exploitation succeeds. No EPSS score is available, so no probabilistic exploitation forecast can be stated.

Business impact categories to consider: loss of management-plane availability during an active incident, SLA violations for any service dependent on the controller, and cascading operational disruption if managed nodes cannot be remotely administered. Because this is an availability-only defect, regulatory reporting obligations triggered by data breach are unlikely, but operational-resilience and availability commitments may still apply.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-65115 NVIDIA Infrastructure Controller Resource Exhaustion DoS
id: 7c6f1a2e-3b4d-4f8a-9c15-8e2d1f0a9b73
status: experimental
description: Detects repeated or anomalous request patterns against an NVIDIA Infrastructure Controller for Linux that may indicate attempted uncontrolled resource consumption (CWE-400), leading to denial of service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65115
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1499
  - attack.impact
logsource:
  category: webserver
  product: nvidia_infrastructure_controller
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
  selection_status:
    sc-status:
      - 200
      - 500
      - 503
  timeframe: 5m
  condition: selection_method and selection_status | count() by src_ip > 200
fields:
  - src_ip
  - cs-method
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate bulk automation or health-check storms
  - Administrative batch operations
level: medium

YARA Rule

rule CVE_2026_65115_NVIDIA_Infrastructure_Controller
{
    meta:
        description = "Detects references to NVIDIA Infrastructure Controller resource-consumption exploitation (CVE-2026-65115)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65115"
        date = "2026-01-01"
        cve = "CVE-2026-65115"
        cwe = "CWE-400"

    strings:
        $cve   = "CVE-2026-65115" ascii wide nocase
        $vend  = "NVIDIA" ascii wide nocase
        $prod1 = "Infrastructure Controller" ascii wide nocase
        $prod2 = "nvidia-infrastructure-controller" ascii wide nocase
        $dos1  = "uncontrolled resource consumption" ascii wide nocase
        $dos2  = "denial of service" ascii wide nocase

    condition:
        $cve or
        ($vend and $prod1) or
        ($prod2 and any of ($dos*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65115 NVIDIA Infrastructure Controller Potential Resource Exhaustion Attempt"; flow:established,to_server; http.user_agent; content:"NVIDIA"; nocase; http.uri; content:"controller"; nocase; threshold: type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:202665115; rev:1; reference:cve,2026-65115; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65115; metadata:created_at 2026_01_01, vendor NVIDIA, product Infrastructure Controller;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and http.request.method in ("GET","POST","PUT") and url.path != null ]
  [ network where network.protocol == "http" and http.request.method in ("GET","POST","PUT") and url.path != null ]
  [ network where network.protocol == "http" and http.response.status_code in (500, 502, 503, 504) ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=pan:traffic
| search "NVIDIA" OR "Infrastructure Controller"
| stats count AS request_count, dc(uri_path) AS unique_paths,
        sum(eval(if(status>=500,1,0))) AS error_count
        BY src_ip, dest_host
| where request_count > 200 AND error_count > 20
| eval risk = if(error_count/request_count > 0.10 AND request_count > 300, "HIGH", "MEDIUM")
| table src_ip, dest_host, request_count, unique_paths, error_count, risk
| sort - request_count

Wazuh OSSEC Rule

<group name="nvidia_infrastructure_controller,cve-2026-65115,">
  <rule id="20265115" level="10" frequency="6" timeframe="60">
    <if_matched_sid>31151</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-65115: Possible uncontrolled resource consumption / DoS attempt against NVIDIA Infrastructure Controller (multiple error responses from same source)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,attack.impact,</group>
  </rule>

  <rule id="20265116" level="12">
    <if_sid>20265115</if_sid>
    <match>NVIDIA Infrastructure Controller</match>
    <description>CVE-2026-65115: High-confidence resource exhaustion against NVIDIA Infrastructure Controller</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,attack.impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no vendor patch, hotfix, or patched version has been identified from any tracked source. No workarounds or official vendor remediation guidance have been published. The compensating controls below are based on the vulnerability class (CWE-400) and the CVSS profile; they do not constitute an official fix.

1) Immediate mitigations

• Restrict network access to the NVIDIA Infrastructure Controller so that only trusted management networks or jump hosts can reach it. Because AV:N applies, reducing reachability directly shrinks the attack surface.
• Enforce least privilege: PR:L means only authenticated low-privileged users can trigger the flaw. Audit all accounts with access to the controller, remove dormant accounts, and apply strong authentication to reduce the pool of potential attackers.
• Rate-limit or throttle requests from individual authenticated sessions at the reverse proxy or load balancer, so that a single session cannot consume disproportionate resources.
• Enable high-availability or failover if the deployment supports it, so that an exhausted instance can be replaced by a healthy one, preserving the management plane.
• Monitor for abnormal resource growth (CPU, memory, connection counts) on the controller host and alert before total exhaustion occurs.

2) Patch/upgrade steps

• Monitor the NVIDIA security bulletin channel and the NVD entry for CVE-2026-65115 for an official fix. Because no vendor fix exists at present, no upgrade action can be specified.
• When a patched build is released, test it in a staging environment that mirrors the production controller configuration, then roll out through a maintenance window with rollback capability.
• Track the NVIDIA product security page and subscribe to advisory notifications to receive patch availability promptly.

3) Long-term hardening

• Adopt a vulnerability-management cadence that includes infrastructure-management components, which are frequently overlooked relative to application servers.
• Apply network segmentation so management planes are never internet-exposed and are isolated from general user networks.
• Implement resource quotas, connection limits, and watchdog restarts for management services to bound the impact of any single resource-exhaustion flaw.
• Maintain current asset inventory, including exact product versions, so that affected builds can be identified immediately when a patch ships.
• Log and retain authentication and request logs on the controller with sufficient retention to support forensic reconstruction of any DoS event.

References

• NVD — CVE-2026-65115: https://nvd.nist.gov/vuln/detail/CVE-2026-65115
• MITRE CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS — not yet scored for CVE-2026-65115 (no score available at time of writing)
• NVIDIA Product Security Advisories (monitor for future patch): https://www.nvidia.com/en-us/security/

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or threat-actor campaign associated with CVE-2026-65115 was identified in the supplied intelligence data. CISA KEV status: not listed.