CVE-2026-65104 NVIDIA CVE debrief

Who should care

Defenders of Megatron-LM deployments, security teams, and vulnerability management teams should assess exposure and prioritize verification of affected versions. Operators of affected platforms and systems should monitor for potential data tampering and review compensating controls for exposed systems.

Why it matters

CVE-2026-65104 allows data tampering and partial information disclosure in NVIDIA Megatron-LM deployments due to hash collisions in the inference cache. Defenders should assess exposure, prioritize verification of affected versions, and monitor for potential data tampering.

• Data tampering and partial information disclosure possible
• Need to verify affected versions and assess exposure
• Monitoring for potential data tampering required

Technical summary

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. This vulnerability may lead to data tampering and partial information disclosure. The vulnerability affects NVIDIA Megatron-LM deployments and has a CVSS score of 7.1. Defenders should assess exposure and prioritize verification of affected versions. The CVE record and NVD detail provide source-grounded information on the vulnerability, but may not cover all affected versions or platforms.

Defensive priority

Assess exposure of Megatron-LM deployments, prioritize verification of affected versions, and monitor for potential data tampering.

Recommended defensive actions

• Assess exposure of Megatron-LM deployments
• Prioritize verification of affected versions
• Monitor for potential data tampering
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

Official CVE Program record and NVD vulnerability detail provide information on the vulnerability. NVIDIA's canonical source confirms affected product. The CVE record and NVD detail provide source-grounded information on the vulnerability, but may not cover all affected versions or platforms. Defenders should verify affected versions and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.