AIKIDO-2026-741515

TL;DR

The awkward package builds and reduces nested array layouts using Python content classes and bundled CUDA kernels that are compiled at runtime. Several of these paths access memory outside allocated buffers for certain array structures, including out-of-bounds writes in the ListOffsetArray and record-array CUDA reduction kernels, a race condition in the record-array CUDA kernel, memory corruption when an IndexedArray with empty content is garbage collected, and unsafe length handling when reconstructing layouts in ak.from_buffers. Processing crafted or malformed array data or buffers can trigger out-of-bounds reads and writes, memory corruption, or crashes. The fix adds bounds and length checks, guards concurrent CUDA writes, validates offsets against content length, and hardens buffer reconstruction.