A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

🗓️ 04 Sep 2025 07:53:39Reported by MicrosoftType

mscve🔗 msrc.microsoft.com👁 5 Views

DPDK vhost_user VRING_SET_NUM memory leak enables DoS via crafted master messages.

Reporter	Title	Published	Views	Family All 95
AlpineLinux	CVE-2019-14818	14 Nov 201900:00	–	alpinelinux
BDU FSTEC	The vulnerability in the collection of libraries and drivers for fast packet processing in dpdk, related to uncontrolled resource consumption, allows a hacker to cause a service failure.	29 Apr 202000:00	–	bdu_fstec
Tenable Nessus	CentOS 8 : dpdk (CESA-2020:1735)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : dpdk (RHSA-2020:1226)	9 Oct 202400:00	–	nessus
Tenable Nessus	Debian DSA-4567-1 : dpdk - security update	14 Nov 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : dpdk (EulerOS-SA-2019-2688)	23 Dec 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : dpdk (EulerOS-SA-2020-1039)	2 Jan 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.5.0 : spdk (EulerOS-SA-2020-1092)	13 Jan 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.2.0 : spdk (EulerOS-SA-2020-1575)	1 May 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.6.0 : spdk (EulerOS-SA-2020-1793)	1 Jul 202000:00	–	nessus

13 Aug 2026 04:06Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 3.17.5

CVSS 37.5

EPSS0.02815

dpdk vhost_user memory_leak denial_of_service privilege_escalation