CVE-2026-92983 InternLM CVE debrief

Who should care

Defenders responsible for InternLM LMDeploy instances, security teams, and system administrators should assess exposure and apply patches or compensating controls as necessary. This includes reviewing and verifying the accuracy of official advisories and CVE records, monitoring for suspicious completion requests, and performing thorough vulnerability management and asset inventory to identify potential exposure.

Why it matters

CVE-2026-92983 is a high-severity vulnerability in InternLM LMDeploy that allows unauthenticated attackers to cause memory exhaustion via session ID mismatch. Defenders should assess exposure, apply patches or compensating controls, and monitor for suspicious activity.

• Memory exhaustion can lead to denial-of-service conditions
• Unauthenticated attackers can exploit this vulnerability to cause system crashes
• Defenders need to verify if deployed versions are vulnerable and apply patches
• Remediation priority is high due to the potential for system instability

Technical summary

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate unreleased scheduler metadata and memory until the prefill worker is out-of-memory killed. This vulnerability can lead to denial-of-service conditions and system crashes if exploited. Defenders should assess exposure and apply patches or compensating controls to prevent potential memory exhaustion.

Defensive priority

High priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of InternLM LMDeploy instances to unauthenticated completion requests
• Verify if the deployed version is prior to 0.17.0 and apply patches if necessary
• Monitor for suspicious completion requests to the proxy endpoint
• Consider implementing compensating controls to limit the impact of potential memory exhaustion
• Review and verify the accuracy of official advisories and CVE records
• Track and document exceptions, retest remediated assets, and close the item only after evidence is documented
• Perform thorough vulnerability management and asset inventory to identify potential exposure

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and remediation steps require verification from official sources. The InternLM LMDeploy repository and specific code snippets should be reviewed to understand the vulnerability and potential impact. Official advisories and CVE records should be consulted for accurate information on affected versions and patches. Defenders should verify if deployed versions are vulnerable and apply patches or compensating controls accordingly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.