Vulnerability in DPDK vhost Library Impacts Multiple Products from Vendor
CVE-2026-93683

6.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Fast Datapath For Rhel 10
Fast Datapath For Rhel 8
Fast Datapath For Rhel 9
Red Hat Enterprise Linux 10
Vendor
CVE Published:
14 October 2026

What is CVE-2026-93683?

A vulnerability has been identified in the DPDK vhost library where improper handling of virtio indirect descriptor tables can lead to issues. In this scenario, the host processes the table length multiple times from guest memory and can create a host copy without validating the length first. If a guest alters the length in between these reads—or if it supplies an incorrect next index—this may cause the host's vhost process to read past the valid memory, potentially leading to crashes or disruptions. The flaw results in out-of-bounds bytes being used inappropriately and not returned to the guest, highlighting a significant residual issue in the indirect descriptor handling that was introduced as part of a prior vulnerability fix.

References

https://access.redhat.com/security/cve/CVE-2026-93683
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2537015
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Naseeb Dangi (AOSP Lab @Nankai University) and Xiang Li (AOSP Lab @Nankai University) for reporting this issue.
.