Out-of-Bounds Write Vulnerability in DPDK's vhost Component Affecting Multiple Versions
CVE-2026-86565

8.2HIGH

Key Information:

Vendor

Red Hat
Status
Fast Datapath For Rhel 10
Fast Datapath For Rhel 8
Fast Datapath For Rhel 9
Red Hat Enterprise Linux 10
Vendor
CVE Published:
14 October 2026

What is CVE-2026-86565?

A flaw exists in the DPDK's vhost component where a guest can misalign the virtqueue size from the inflight descriptor table size. This desynchronization leads to potential out-of-bounds write operations within the host's vhost process, which may result in instability or exploitation risks. Users of DPDK are advised to monitor for updates and apply patches promptly to mitigate associated threats.

References

https://access.redhat.com/security/cve/CVE-2026-86565
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529683
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.