CVE-2026-73557

CVE-2026-73557 is not a code bug — it is a structural mismatch between PyTorch's process-global sparse tensor state management and asyncio concurrency that cannot be patched away without architectural changes. The vulnerability lives in a design collision, not a mistake in either component. PyTorch's `check_sparse_tensor_invariants` uses process-global save/enable/restore semantics — a threading model designed for sequential ML workflows, not concurrent serving. When vLLM's `AsyncMultiModalItemTracker` uses `asyncio.gather` to resolve multimodal items concurrently, it races on this global state. The result: a guard written to catch invalid sparse tensors (CVE-2025-62164) becomes bypassable precisely because concurrent requests interleave their enable/restore calls. The 0.26.0 fix likely moved the invariant check outside the `asyncio.gather` scope entirely rather than implementing thread-local state. This is scope isolation — a surgical patch that closes the race window but leaves the underlying incompatibility intact. Thread-local state would have been a real architectural fix that generalizes; scope isolation fixes this instance but creates a precedent that may normalize wrapping non-async-safe PyTorch C extensions in asyncio.gather. What makes this analytically significant: neither the CVE-2025-62164 fix nor the AsyncMultiModalItemTracker concurrency pattern is individually wrong — they are incompatible compositions. The prior CVE patched the symptom (invalid sparse tensors reaching `to_dense`). This CVE patches the enabling condition (race on global state). But if vLLM developers continue to compose asyncio concurrency with PyTorch's global state mechanisms, similar races likely exist elsewhere — gradient checkpoints, memory caching, and device management all use process-global state that may face the same vulnerability class. Check: (1) Whether the 0.26.0 fix uses thread-local or task-local state rather than locks — if it locks, it may introduce new contention; (2) Whether this same composition failure exists in HuggingFace Transformers serving paths; (3) The actual exploitability chain — does a bypassed invariant check cause crashes, memory corruption, or model poisoning under concurrent load? The CVSS 6.3 score measures crash radius, not the contamination radius through KV caches and output token distributions that a corrupted embedding can reach.

Reviewed through automated stages and approved by a human before publication.