CVE-2026-86562

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in DPDK VDUSE Control-Queue

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86562

EUVD

EUVD-2026-101421

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Fast Datapath for RHEL 10 *
Red	Hat	Fast Datapath for RHEL 8 *
Red	Hat	Fast Datapath for RHEL 9 *
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat OpenShift Container Platform 4 *
Red	Hat	Red Hat OpenStack Platform 13 (Queens) *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

CVE-2026-86562 is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in DPDK's lib/vhost component. It involves a double-fetch of control-queue descriptors that leads to a heap buffer overflow. An attacker with access to the VDUSE control virtqueue in a guest system can exploit this flaw to cause instability or execute unauthorized code.

Detection Guidance

Detection requires monitoring for heap buffer overflows in DPDK lib/vhost, particularly in VDUSE control-queue handling. Check for crashes or instability in virtualization environments using DPDK. Review logs for virtio_net_ctrl_pop() errors or descriptor-related issues. No specific commands are provided in the resources.

Impact Analysis

This vulnerability can cause resource exhaustion, system crashes, or instability. It may also allow unauthorized code execution or privilege escalation on affected systems. The impact depends on whether the vulnerable component is used in your environment.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized access to sensitive data due to heap buffer overflow and privilege escalation risks. Exploitation may lead to data breaches, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

No mitigation is currently available according to Red Hat. Monitor vendor advisories for updates. Isolate affected systems if possible. Apply vendor patches once released. Track bugzilla.redhat.com/2529667 for progress.

Hi! I’m here to help you understand CVE-2026-86562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70