Unrated

Write-What-Where Code Execution in NVIDIA BlueField VIRTIO-Net

IdentifiersCVE-2026-65094CWE-123

CVE-2026-65094 is a CWE-123 write-what-where vulnerability in the NVIDIA BlueField-3 Virtio-Net implementation, affecting NVIDIA Networking BlueField/ConnectX VIRTIO-Net deployments. A virtual-machine user can send a crafted message that causes data to be written to unintended memory locations. The resulting arbitrary-write condition can lead to code execution within the Virtio-Net scope. CVE-2025-33209 was withdrawn and replaced by this identifier.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can provide attacker-controlled code execution in the Virtio-Net scope. Because the affected component processes networking in a shared DPU/networking layer, exploitation may affect resources beyond the originating VM context and poses particular risk in multi-tenant or virtualized environments. Potential consequences include compromise of shared networking processing, bypass of controls implemented at that layer, disruption of network traffic processing, and lateral movement opportunities across workloads.

Mitigation

If you can’t patch tonight, do this now.

No vendor-specific workaround is available. Until affected systems are upgraded, restrict untrusted VM or tenant access to shared networking resources where operationally feasible, assess exposure in multi-tenant deployments, and monitor for anomalous Virtio-Net or network-processing behavior.

Remediation

Patch, then assume compromise.

Upgrade NVIDIA VIRTIO-Net for BlueField to a fixed release: VIRTIO-Net GA 25.10.6 or later, LTS25 25.10.2 or later, LTS24 24.10.50 or later, or LTS23 23.10.23 or later.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

NvidiaVirtio-Netapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

cyber security newsNews

Jul 29, 2026

NVIDIA BlueField Vulnerability Enables Code Execution Attacks

A high-severity write-what-where vulnerability in NVIDIA BlueField-3 Virtio-Net / VIRTIO-Net that could allow low-privileged VM users to achieve code execution on affected systems, particularly in shared or multi-tenant environments.

nvidia product securityNews

Jul 28, 2026

Commit 967ae0d3381a668b7ab02591f7290126d5e1f57a at 2026-07-28T17:42:5… · NVIDIA/product-security@5d609e0 · GitHub

A critical write-what-where vulnerability in NVIDIA VIRTIO-Net for Bluefield Virtio-Net that can be triggered by a crafted message from a VM user, potentially leading to code execution in the Virtio-Net scope.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-65094

NVD

nvd.nist.gov/vuln/detail/CVE-2026-65094

MITRE CWE · CWE-123

cwe.mitre.org

Write-What-Where Code Execution in NVIDIA BlueField VIRTIO-Net

IdentifiersCVE-2026-65094CWE-123