As of May 10, 2026, CVE-2026-9912 has no public CVE.org or NVD entry. This deep dive explains the claimed GPU JIT leak path. Read now for engineers.
What the Claim Actually Describes
CVE-2026-9912 is framed as a GPU shared-memory JIT leak: secrets or intermediate state that should stay isolated end up readable through memory that JIT-compiled GPU code and host-side consumers share. As of May 10, 2026, there is no public CVE.org or NVD entry for this identifier, so treat every public write-up as a claim to validate, not as a finished vulnerability record. The useful work is to map the alleged path—where JIT output lands, which buffers are reused, and who can observe them—rather than to debate a number that may still be unofficial.
Shared memory on the GPU is chosen for speed: kernels exchange tiles, caches, and scratch data with low latency. JIT compilation adds another layer: runtime-generated kernels, constant tables, and relocation data often sit in regions the host can map or that later kernels can still touch. A leak path appears when those regions are not zeroed, not re-keyed per tenant, or not unbound before the next workload runs. The bug class is residual visibility after a trust boundary is supposed to have closed.
How a Shared-Memory JIT Leak Path Works
Start from the pipeline, not the acronym. A runtime lowers a high-level kernel, emits machine code or intermediate IR, places it and related constants into device memory, then launches work that reads and writes shared regions. If the allocator recycles pages without sanitizing them, if debug or profiling hooks leave mappings live, or if a subsequent process on the same device can attach to leftover buffers, prior JIT material and prior kernel scratch can surface. The “shared” part matters: what was intended as intra-kernel cooperation becomes a side channel across jobs, users, or isolation domains that the platform promised were separate.
Engineers should separate three questions. First, is the residual content from the JIT artifact itself (code, constants, relocation metadata) or from application data the kernel processed while that artifact was live? Second, is the observer another GPU kernel, a host process with a device mapping, or a tool chain that dumps GPU memory for diagnostics? Third, does the platform’s isolation model claim process-level, container-level, or multi-tenant device-level separation? A leak that only appears when two untrusted jobs share one physical GPU is a different operational problem than a leak inside a single trusted process.
What Engineers Should Verify Before Acting
- Confirm whether the CVE string maps to a vendor advisory you control, or only to secondary reports that restate the title.
- Inventory which runtimes on your fleet use GPU JIT or runtime kernel generation and where they store compiled output.
- Check whether device memory is zeroed or unmapped between tenants, contexts, or jobs that must not see each other.
- Reproduce only on systems you own: capture whether residual buffers retain prior JIT or workspace content after context teardown.
- Document the actual trust boundaries (single user vs multi-tenant GPU) before you prioritize a fix.
Until an authoritative database entry exists, avoid treating the identifier alone as proof of scope or severity. Prefer vendor changelogs, runtime release notes, and your own reproduction notes. If you cannot show residual cross-context reads under your configuration, keep the issue tracked as a hypothesis and keep monitoring for an official record.
Practical Hardening While the Record Is Incomplete
Hardening does not require a full public CVE dossier. Prefer precompiled kernels where the workload allows it so less sensitive material is written at runtime. Force context reset and buffer release between untrusted jobs; do not rely on “the next allocation will overwrite soon.” Disable or tightly gate GPU memory dump and profiling paths on multi-tenant hosts. Run untrusted GPU work on dedicated devices or partitions when the platform offers that isolation. Log which runtime versions and driver stacks sit on shared accelerators so you can match future official guidance without guessing.
Write runbooks around observable failure modes: unexpected cross-job data, JIT cache directories that retain prior tenants’ artifacts, and mappings that outlive process exit. When a formal CVE or NVD entry finally appears, reconcile it against those notes—update scope, not the whole architecture, unless the official description proves a wider path than you already closed.