CVE-2026-86566

Awaiting Analysis Awaiting Analysis - Queue

DPDK vhost RX Descriptor Underflow Leading to DoS

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86566

EUVD

EUVD-2026-101508

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Fast Datapath for RHEL 10 *
Red	Hat	Fast Datapath for RHEL 8 *
Red	Hat	Fast Datapath for RHEL 9 *
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat OpenShift Container Platform 4 *
Red	Hat	Red Hat OpenStack Platform 13 (Queens) *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is in DPDK's lib/vhost component where a guest with runt RX descriptors can cause an unsigned subtraction underflow in the copy length during vhost enqueue operations. This leads to a full packet copy exceeding a small descriptor window, potentially crashing a host virtual switch like OVS-DPDK.

Detection Guidance

Monitor for crashes or instability in OVS-DPDK or DPDK-based services. Check logs for vhost enqueue errors or segmentation faults. Use tools like tcpdump or Wireshark to inspect RX descriptors for anomalies. No specific commands are provided in the resources.

Impact Analysis

The vulnerability can cause a denial of service in shared vhost backends like OVS-DPDK, leading to crashes, resource consumption, or system instability. It primarily affects availability and may require system restarts to recover.

Compliance Impact

This vulnerability primarily impacts system availability by causing crashes or instability in shared vhost backends like OVS-DPDK. For compliance with standards such as GDPR or HIPAA, which require maintaining data availability and integrity, this could lead to disruptions in services handling sensitive data. Downtime or instability may violate availability requirements under these regulations.

Mitigation Strategies

No effective mitigation is currently available per Red Hat. Monitor Red Hat advisories for updates or consider upgrading to supported versions if available. Avoid using vulnerable DPDK versions in shared vhost backends like OVS-DPDK.

Hi! I’m here to help you understand CVE-2026-86566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70