NVIDIA Patches Critical VIRTIO-Net Flaw in BlueField 3 Allowing VM Code Execution
NVIDIA has released a security update addressing a critical vulnerability in the VIRTIO-Net component used with its BlueField 3 DPU. The flaw, tracked as CVE-2026-65094, enables virtual machine users to execute arbitrary code within the VIRTIO-Net execution context through crafted messages that perform unauthorized memory writes. Originally assigned CVE-2025-33209, the identifier was later withdrawn and replaced. The issue was discovered internally by NVIDIA and carries a CVSS v3.1 base score of 9.0, rated Critical. Affected versions include VIRTIO-Net 25.10.6, 25.10.2, 24.10.50, and 23.10.23, with fixes available in subsequent releases. Organizations are advised to update immediately to mitigate the risk of code execution by untrusted VM tenants.
Security NEXTJul 29, 2026Translated from Japanese