CVE-2026-86565

Awaiting Analysis Awaiting Analysis - Queue

DPDK vhost Out-of-Bounds Write in Virtqueue Handling

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86565

EUVD

EUVD-2026-101423

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Fast Datapath for RHEL 10 *
Red	Hat	Fast Datapath for RHEL 8 *
Red	Hat	Fast Datapath for RHEL 9 *
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat OpenShift Container Platform 4 *
Red	Hat	Red Hat OpenStack Platform 13 (Queens) *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds write flaw in DPDK's lib/vhost component. A guest virtual machine can desynchronize the virtqueue size from the inflight descriptor table size, causing the host vhost process to write outside allocated memory. This may lead to memory corruption or other security issues.

Detection Guidance

Monitor DPDK vhost processes for abnormal behavior such as crashes or memory corruption. Check logs for out-of-bounds write errors in vhost-user related services. Use tools like strace or gdb to trace vhost process operations if suspicious activity is detected.

Impact Analysis

An attacker in a guest VM could exploit this to corrupt host memory, execute unauthorized code, or cause a denial of service. Systems using vhost-user-blk or vhost-user-scsi devices with the inflight feature are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized code execution or memory corruption, which may result in data breaches or loss of data integrity. Such incidents could violate GDPR's requirements for data protection and HIPAA's safeguards for protected health information, potentially leading to compliance failures.

Mitigation Strategies

Disable vhost-user-blk or vhost-user-scsi devices with the inflight feature if used. Isolate guest VMs using these devices from critical systems. Monitor for updates from Red Hat and apply patches once available. Consider upgrading to supported versions if affected.

Hi! I’m here to help you understand CVE-2026-86565. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70