CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. Mitigation No mitigation is currently available...

CVE-2026-86563: Incorrect Calculation of Buffer Size

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access...

CVE-2026-86566: Integer Underflow (Wrap or Wraparound)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK...

PT-2026-114308

Name of the Vulnerable Software and Affected Versions DPDK affected versions not specified Description A flaw exists in the DPDK lib/vhost vhost-crypto component. When mapping a guest descriptor fails, the write-back chain cleanup process may follow an uninitialized next pointer. This behavior ca...

CVE-2026-86848: Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend...

CVE-2026-86849: Out-of-bounds Write

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend...

CVE-2026-86846: Out-of-bounds Write

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend...

CVE-2026-86561: Allocation of Resources Without Limits or Throttling

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

CVE-2026-86847: Access of Uninitialized Pointer

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash...

CVE-2026-86845: Expired Pointer Dereference

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend...

Linux Distros Unpatched Vulnerability : CVE-2026-86566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vho...

PT-2026-122679

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process...

CVE-2026-86565: Out-of-bounds Write

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process...

PT-2026-114300

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw exists in the lib/vhost library where memory size is not adequately validated before the mmap operation during vhost memory-region setup. This lack of validation can result in memory...

PT-2026-114301

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A TOCTOU Time-of-Check to Time-of-Use double-fetch of control-queue descriptors in the lib/vhost library leads to a heap buffer overflow. This occurs within the VDUSE control-queue handler, allowi...

PT-2026-114302

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw in the lib/vhost library involves a double-offset bug during the calculation of vhost log mapping, which can result in incorrect memory access. Recommendations Update to version 25.11.4-1.1...

PT-2026-114309

Name of the Vulnerable Software and Affected Versions DPDK affected versions not specified Description A flaw exists in the DPDK lib/vhost vhost-crypto component. The indirect-descriptor snapshot performs a double-fetch of a guest descriptor next index, creating a time-of-check/time-of-use TOCTOU...

Linux Distros Unpatched Vulnerability : CVE-2026-86567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. CVE-2026-865...

Linux Distros Unpatched Vulnerability : CVE-2026-86563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. CVE-2026-86563 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-86847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causin...