CVE-2026-86563

Awaiting Analysis Awaiting Analysis - Queue

Double-Free Memory Corruption in DPDK vhost

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86563

EUVD

EUVD-2026-101422

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Fast Datapath for RHEL 10 *
Red	Hat	Fast Datapath for RHEL 8 *
Red	Hat	Fast Datapath for RHEL 9 *
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat OpenShift Container Platform 4 *
Red	Hat	Red Hat OpenStack Platform 13 (Queens) *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

CVE-2026-86563 is a flaw in DPDK's lib/vhost component where a double-offset bug in vhost log mapping calculation causes incorrect memory access. The mmap offset is applied twice, leading to improper memory handling which can cause security issues or system instability.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable DPDK versions and inspecting vhost log mapping configurations. Review DPDK logs for memory access errors or crashes. Check for double-offset errors in vhost log mapping calculations. Use system monitoring tools to detect unusual memory access patterns or instability in virtualized environments.

Impact Analysis

This vulnerability can allow a malicious guest controlling vhost-user log mapping to exploit the flaw. Potential impacts include denial of service, unauthorized code execution, or memory read/modification, which could compromise system security and stability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory access or modification, which may lead to data breaches or unauthorized data exposure. Improper memory handling in DPDK's vhost component could allow malicious actors to read or alter sensitive data, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediate mitigation steps include updating DPDK to the latest patched version if available. If no patch exists, disable vhost-user functionality in DPDK if not required. Monitor systems for signs of exploitation or instability. Apply vendor-specific mitigations or workarounds provided by Red Hat or other affected vendors.

Hi! I’m here to help you understand CVE-2026-86563. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70