CVE-2026-84286

A critical OOB memory access vulnerability in the exllamav3 ext CUDA extension allows for immediate DoS via a crafted input. Tracked as CVE-2026-84286 , the flaw lies in the kernel dispatch logic where the block index ( cbi ) is used to access a fixed 24-entry array without validation.

Technical Breakdown - Root Cause: Missing bounds check on the kernel parameter K . Setting K=0 generates a negative array index, triggering a CUDA illegal memory access. - Impact: Immediate process crash (DoS) or application instability. - Affected Component: exllamav3 ext CUDA kernel-table dispatch process. - MITRE TTP: Likely maps to T1498 (Network Denial of Service) or T1499 (Endpoint Denial of Service) via application crash.

Defense Update to the latest commit or apply the fix from the merged PR (turboderp-org/exllamav3#310). No workaround exists; this is a code-level patch.

Source: https://kb.cert.org/vuls/id/369611