Initial version (official) 2026-09-30
Preface: The AMD ROCm Communication Collectives Library (RCCL) is a standalone library designed to provide highly optimized, multi-GPU and multi-node collective communication primitives specifically for AMD GPU hardware architectures.
While compiler technologies like AMD HIP allow standard C++ code to be compiled for parallel execution across different GPU backends, RCCL focuses entirely on the data movement and synchronization bottlenecks that occur when scaling workloads across dozens, hundreds, or thousands of GPUs.
Background: Refer to the attached diagram, an example in C++ using the HIP API (AMD’s CUDA equivalent) to demonstrate how RCCL mirrors the NVIDIA NCCL API.
Because RCCL provides complete software parity, the function names, data types, and configurations are structurally identical to NCCL—you simply replace the nccl prefix with rccl (or use the HIP translation headers which can map them automatically).
RCCL Collective Communication Reference (C++) – This example initializes a single-node, multi-GPU environment and performs an AllReduce operation (the core collective used in distributed AI training to synchronize gradients).
When your application invokes ncclAllReduce(…), your code hands over control to the backend library. If a malicious or compromised peer on your network sends a bad payload during that phase, RCCL’s background proxy thread will instantly parse it, improperly validate it, and dereference an attacker-controlled pointer.
Because this pointer dereference leads directly to memory corruption or Remote Code Execution (RCE) during the execution of the call, the program will either crash or be silently exploited. Control will never return to your if (res != ncclSuccess) check.
Vulnerability details: CVE-2026-43598 – Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution.
Official announcement: Please refer to the link for details –
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6033.html