CVE-2025-2953: linuxfoundation pytorch Improper Resource Shutdown or Release
CVSS: 5.5v3.1MediumModified
AliasesGHSA-3749-ghw9-m3mgBIT-pytorch-2025-2953PYSEC-2025-191UBUNTU-CVE-2025-2953DEBIAN-CVE-2025-2953CGA-272q-fvx7-ppjjCGA-2c85-4mp5-cvq6CGA-2g8r-x9g4-f6rqCGA-2mfh-5m5m-hc7jCGA-2v2v-2v7x-jwf6CGA-2xrc-fxfc-jgmxCGA-327f-q4mg-x4xfCGA-34mp-2j2m-q4mpCGA-3637-7xh7-x23xCGA-377v-j555-2v99CGA-3h6m-jc9f-pvqjCGA-3xv8-25cg-c65mCGA-4234-whxg-8hc9CGA-42h9-pcw6-77f2CGA-4mr3-mr57-fv46CGA-546f-hr2c-hg8pCGA-5623-9hqv-hjxjCGA-5fpw-6fmj-2v6cCGA-5vfc-7m4v-3fx9CGA-62x4-2wq4-5mm3CGA-65rr-9wpr-6c55CGA-6976-hvp4-g4rwCGA-6f36-3f7v-29pqCGA-6rfh-wgc2-6vqrCGA-6w8g-qgx5-xvmvCGA-738p-66wx-5g37CGA-7fqh-rgpw-hxc4CGA-7g5x-59ff-38q2CGA-85mf-557v-cqwwCGA-86pq-wp5v-9x33CGA-8mx9-9c7v-c24hCGA-8p3q-2h84-3rhpCGA-8rh3-2894-fcq8CGA-955h-v793-c9f9CGA-95qx-qx8j-2vwmCGA-9xmx-hcgh-j7f2CGA-c3mh-646f-28rjCGA-c87m-4hmc-868cCGA-cp68-9c3c-5fmhCGA-f52j-hcr9-6h94CGA-f7hr-c7wq-p5hvCGA-f8w3-2mg2-ghxrCGA-f9j8-q6w4-2rhmCGA-g2jj-7f5g-j2gcCGA-g9ph-j2wh-hhwqCGA-h7h8-7pgp-j8x6CGA-hh4f-6567-j647CGA-hw62-pp7f-g692CGA-jxw7-p997-vfwxCGA-m885-3fwm-8vr8CGA-mp26-jxxq-wjrfCGA-mxrq-xmph-cv6pCGA-pfpg-f48q-5gmxCGA-pgrh-c9g4-mm9fCGA-pm84-j939-p27fCGA-qhxq-v9cm-rwm2CGA-qmg6-wm58-g89gCGA-qqh9-4vm6-p3wxCGA-r335-3xwc-w6rpCGA-r5jp-fc4x-8m77CGA-r63j-gmmq-4rmpCGA-r838-pv45-ffr5CGA-rq73-8f43-h8mrCGA-vv4v-7rh5-56r6CGA-vw4r-7p2w-8jwjCGA-w3vv-xjc2-v32xCGA-w6h2-6x2p-pwh5CGA-w85v-jw86-3chjCGA-wcp2-cmp6-gcrrCGA-wj99-j78j-q8gjCGA-wjp4-xf6x-63fcCGA-wphw-9w67-9f83CGA-x4mx-mjv4-h2mcCGA-x7cr-5878-9hghCGA-x8c7-9qf2-5q42CGA-xj7g-r3qf-x2gjCGA-xjpj-xq6j-p2w2
Published 30-03-2025Last modified 22-04-2025
Vulnerability summary
CVE-2025-2953 is a medium (CVSS 5.5) Improper Resource Shutdown or Release vulnerability in linuxfoundation pytorch. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 30-03-2025PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.
CVSS metrics
12 scores · 6 sources · 4 versionsMedium 4.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSources6 sources · 3.3–5.5
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Low 3.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSourcesSingle source
Low 1.7Preferred score · CVE.org (CNA)
AV:L/AC:L/Au:S/C:N/I:N/A:PSourcesAll 2 agree
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 21-09-2026
21-09-202621-10-2026
EPSS score0.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPytorch
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard39 products
- libtorch-cuda-12.4< 2.7.1-r0
- libtorch-cuda-12.4-dev< 2.7.1-r0
- libtorch-cuda-12.6< 2.7.1-r0
- libtorch-cuda-12.6-dev< 2.7.1-r0
- py3-supported-torch-cuda-12.4< 2.7.1-r0
Debian1 product
- pytorchAll versions (No fix recorded)
Linuxfoundation1 product
- pytorch2.6.0\+cu124
PyPI1 product
- torch< 2.7.1-rc1 | ≤ 2.6.0+cu124
Ubuntu1 product
- pytorchAll versions (No fix recorded)
5 vendors · 43 products
References
13 links
- github.com/pytorch/pytorchPACKAGE
