Vulnerability in DPDK Affecting VDUSE Handler Functionality
CVE-2026-86567

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Fast Datapath For Rhel 10
Fast Datapath For Rhel 8
Fast Datapath For Rhel 9
Red Hat Enterprise Linux 10
Vendor
CVE Published:
14 October 2026

What is CVE-2026-86567?

A flaw exists in the DPDK library's handling of virtual disk user space devices (VDUSE). When the Input/Output Translation Lookaside Buffer (IOTLB) is invalidated, the handler fails to invalidate the associated vring pointers. This oversight can lead to a use-after-unmap situation, potentially allowing attackers to reference freed memory, resulting in unexpected behaviors or even execution of arbitrary code. Addressing this issue is critical to ensure the integrity of the VDUSE functionality within DPDK.

References

https://access.redhat.com/security/cve/CVE-2026-86567
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529685
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Don Salvatore Nero for reporting this issue.
.