CVE-2025-46149
📋 TL;DR
This CVE describes an assertion error vulnerability in PyTorch's nn.Fold module when using the inductor compiler. The vulnerability can cause denial of service by crashing applications that use affected PyTorch functionality. Users running PyTorch with inductor enabled for nn.Fold operations are affected.
💻 Affected Systems
- PyTorch
📦 What is this software?
Pytorch by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service in production systems using PyTorch with inductor for nn.Fold operations.
Likely Case
Development or inference pipeline failures when processing specific tensor shapes with nn.Fold and inductor enabled.
If Mitigated
Minor development disruption with quick workaround available.
🎯 Exploit Status
Requires specific tensor shapes and inductor usage to trigger assertion error. No known remote exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PyTorch 2.7.0 and later
Vendor Advisory: https://github.com/pytorch/pytorch/issues/147848
Restart Required: No
Instructions:
1. Upgrade PyTorch to version 2.7.0 or later using pip: 'pip install torch==2.7.0' or 'pip install --upgrade torch'. 2. Verify the fix by testing nn.Fold operations with inductor enabled.
🔧 Temporary Workarounds
Disable inductor for nn.Fold operations
allTemporarily disable the inductor compiler when using nn.Fold to avoid the assertion error.
torch._inductor.config.triton.cudagraphs = False
torch._inductor.config.cpp.enabled = False
🧯 If You Can't Patch
- Avoid using nn.Fold with inductor compiler enabled in production code
- Implement error handling to catch assertion errors and gracefully degrade functionality
🔍 How to Verify
Check if Vulnerable:
Check if using PyTorch <2.7.0 and test nn.Fold with inductor enabled on problematic tensor shapes.Check Version:
python -c "import torch; print(torch.__version__)"Verify Fix Applied:
After upgrading to PyTorch 2.7.0+, test the same nn.Fold operations that previously triggered assertion errors.📡 Detection & Monitoring
Log Indicators:
- AssertionError in PyTorch logs
- Application crashes with PyTorch stack traces mentioning nn.Fold or inductor
Network Indicators:
- None - this is a local library issue
SIEM Query:
source="*pytorch*" AND ("AssertionError" OR "nn.Fold" OR "inductor")