Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-11-10T16:30:29 neural-compressor: neural-compressor: Privilege escalation via protection mechanism failure 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CWE-266

Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

A flaw was found in neural-compressor due to a failure in its protection mechanism within user applications. A local attacker could exploit this issue with passive interaction from a privileged user to achieve privilege escalation. Successful exploitation allows an unprivileged attacker to gain elevated privileges on the system.

A protection mechanism failure in Intel Neural Compressor allows a local, unprivileged user with passive user interaction to escalate privileges within user-space applications, resulting in high confidentiality, integrity, and availability impacts. Restrict interactive shell access and execution of untrusted model quantization or evaluation workflows within Intel Gaudi vLLM containers to trusted, least-privileged service accounts, and run inference pods with standard OpenShift security context constraints (SCCs) that drop unnecessary capabilities and prevent privilege escalation. Red Hat AI Inference Server Not affected rhaii-fast/vllm-gaudi-rhel9 Red Hat AI Inference Server Not affected rhaii/vllm-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-40704 https://nvd.nist.gov/vuln/detail/CVE-2026-40704 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html