PyTorch MKLDNN zero_() can overflow half-precision CPU tensors
A reported CPU path writes float32-sized zeros into bfloat16 and float16 MKLDNN buffers, crashing the process.
Calling zero_() on a CPU MKLDNN tensor stored as bfloat16 or float16 can write past the end of the buffer and abort the process, according to a bug report filed against PyTorch. The same call is reported to work for float32.
The report says the MKLDNN zeroing path treats the tensor's data as an array of 32-bit floats and writes one float per element. Half-precision elements are half that size, so the write can cover twice the allocated bytes. On PyTorch 2.10.0 for CPU on Linux, a small bfloat16 example aborted inside the allocator with an invalid chunk size; the float16 case also produced heap corruption and a SIGABRT. The reporter expected zero_() to clear any supported MKLDNN dtype safely, and said the same float-sized write is still present in 2.15.0 and on main. The suggested remedy is dtype- or byte-count-aware initialization, plus regression tests for both half-precision types.
No CVE is attached to the report, and it does not describe a confirmed fix.