Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-04-27T16:45:12 vllm: vllm: Uninitialized resource in KV Block Handler via has_mamba_layers function 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CWE-908

A flaw was found in vllm. A remote attacker can exploit a vulnerability in the `has_mamba_layers` function within the KV Block Handler component. By performing a specific manipulation, an uninitialized resource can be triggered, potentially leading to information disclosure or denial of service. The attack is considered to have high complexity, and exploitation is difficult.

This Moderate impact vulnerability in vllm, affecting Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, involves an uninitialized resource in the `has_mamba_layers` function. Exploitation by a remote attacker could lead to information disclosure or denial of service, but the attack complexity is high, making exploitation difficult. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat AI Inference Server Fix deferred rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-neuron-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-spyre-rhel9 Red Hat AI Inference Server Fix deferred rhaiis/vllm-tpu-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gcp-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-agent-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-controller-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-router-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-storage-initializer-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-vllm-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-vllm-rocm-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-7141 https://nvd.nist.gov/vuln/detail/CVE-2026-7141 https://github.com/AjAnubolu/vllm/commit/1ad67864c0c20f167929e64c875f5c28e1aad9fd https://github.com/vllm-project/vllm/issues/39146 https://github.com/vllm-project/vllm/issues/39146#issue-4215090365 https://github.com/vllm-project/vllm/pull/39283 https://vuldb.com/submit/801297 https://vuldb.com/vuln/359740 https://vuldb.com/vuln/359740/cti