CVE-2026-65164 NVIDIA CVE debrief

Who should care

Defenders responsible for systems running NVIDIA AIStore for Linux versions 0 to 4.9 should assess exposure and prioritize remediation. This includes administrators, security teams, and incident response personnel.

Why it matters

CVE-2026-65164 is a high-severity path traversal vulnerability in NVIDIA AIStore for Linux that could allow remote attackers to create or overwrite files, execute code, disclose information, tamper with data, or cause denial of service. Defenders should prioritize inventory checks, compensating controls, and remediation to prevent potential exploitation.

• Potential for arbitrary file creation or overwrite, allowing for data tampering or code execution.
• Possible information disclosure due to improper limitation of pathname to restricted directories.
• Denial of service could occur if an attacker can cause the system to become unresponsive or crash.
• Verification of vendor remediation and patch application is necessary to prevent exploitation.

Technical summary

The CVE record describes a path traversal vulnerability in the dSort archive extraction component of NVIDIA AIStore for Linux. A remote attacker may supply crafted archive member names to a dSort job, potentially leading to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service. The vulnerability allows improper limitation of a pathname to a restricted directory. Defenders should prioritize inventory checks, compensating controls, and remediation to prevent potential exploitation. The affected product context requires defensive impact assessment and source-grounded technical framing to address potential security risks.

Defensive priority

High

Recommended defensive actions

• Review and update inventory to identify systems running NVIDIA AIStore for Linux versions 0 to 4.9.
• Implement compensating controls, such as restricting access to the dSort component and monitoring for suspicious activity.
• Verify vendor remediation and apply patches or updates as available.
• Consider additional security measures, such as validating archive member names and restricting file system access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in NVIDIA AIStore for Linux. The vulnerability allows a remote attacker to cause improper limitation of a pathname to a restricted directory, potentially leading to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.