Buffer Overflow Vulnerability in DPDK nfp vDPA Driver by Red Hat
CVE-2026-86856

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Fast Datapath For Rhel 10
Fast Datapath For Rhel 8
Fast Datapath For Rhel 9
Red Hat Enterprise Linux 10
Vendor
CVE Published:
14 October 2026

What is CVE-2026-86856?

A vulnerability exists in the DPDK nfp vDPA driver that could allow stack and heap buffer overflows. This issue occurs when multiple virtqueues are configured, exceeding the size limitations for buffer allocation intended for a single queue pair. As a result, this can lead to serious issues, including host crashes or memory corruption, potentially affecting system stability and performance.

References

https://access.redhat.com/security/cve/CVE-2026-86856
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529897
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Anthropic Research for reporting this issue.
.