CVE-2026-94627

Summary

The vLLM Mooncake connector has a memory management flaw where GPU KV cache blocks aren't properly released when concurrent requests share the same transfer ID, leading to gradual memory exhaustion that eventually prevents legitimate requests from processing.

Exploitability

Exploitation is relatively straightforward requiring only submission of multiple completion requests with shared transfer IDs, though it may require specific deployment configurations with prefill/decode disaggregated setups.

Blast radius

In production deployments with high request volumes, this flaw could cause complete service unavailability as GPU memory fills up and legitimate requests fail to execute, potentially affecting all users of the affected LLM inference service.

Detection

Monitor GPU memory usage patterns showing gradual increase over time with no corresponding release of memory blocks, and watch for process restarts or memory exhaustion errors in system logs.

Prioritized remediation

Upgrade to vLLM Mooncake connector version 0.29.1 or later which contains the fix for the KV cache block ownership management issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.