CVE-2026-86847

Awaiting Analysis Awaiting Analysis - Queue

DPDK vhost-crypto Uninitialized Pointer Flaw

Publication date: 2026-10-14

Last updated on: 2026-11-06

Assigner: redhat-SADP

Description

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-11-06

Generated

2026-11-08

AI Q&A

2026-10-15

EPSS Evaluated

2026-11-07

NVD

CVE-2026-86847

EUVD

EUVD-2026-101511

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	Fast Datapath for RHEL 10	*
Red Hat	Fast Datapath for RHEL 8	*
Red Hat	Fast Datapath for RHEL 9	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 8	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenStack Platform 13 (Queens)	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-824	The product accesses or uses a pointer that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability is in DPDK's lib/vhost vhost-crypto component. When mapping a guest descriptor fails, it causes an uninitialized next pointer in the write-back chain cleanup process. This can make the host vhost-crypto process hang or crash.

Detection Guidance

Check if vhost-crypto is enabled and running on your system. Look for processes using virtio-crypto vhost-user devices. Monitor for crashes or hangs in the vhost-crypto process. Review logs for failed guest descriptor mappings or write-back chain cleanup errors.

Impact Analysis

An attacker with access to a virtio-crypto vhost-user device could exploit this to cause the host vhost-crypto process to hang or crash, leading to service disruption. The impact depends on whether vhost-crypto is built and enabled in your environment.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially causing service disruptions or crashes in systems handling sensitive data. GDPR requires ensuring data availability and integrity, while HIPAA mandates reliable access to protected health information. A crash or hang in vhost-crypto could disrupt these requirements.

Mitigation Strategies

Do not attach a virtio-crypto vhost-user backend to untrusted guests. Disable vhost-crypto if not required. Apply vendor patches when available. Monitor for updates from Red Hat or DPDK maintainers.

Hi! I’m here to help you understand CVE-2026-86847. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...