DPDK vhost: Heap buffer overflow via double-fetch in VDUSE control queue
Summary
A time-of-check to time-of-use (double-fetch) flaw in the DPDK vhost library lets a malicious guest with access to the VDUSE control virtqueue trigger a heap buffer overflow with attacker-controlled content on the host. Successful exploitation could lead to host memory corruption, and in principle to code execution on the host. The attack requires local access and a foothold in a guest or container that uses a DPDK vhost VDUSE backend.
Affected
- DPDK lib/vhost, VDUSE control-queue handler
- Red Hat Fast Datapath for RHEL 8, 9 and 10 (listed as affected by the CNA)
- Debian 12 and 13 packages with affected DPDK versions (per OSV, versions listed as affected are unverified)
- Azure Linux: dpdk versions below 23.11.8-1 (per Vulners, unverified)
- Affected version ranges conflict between sources and are not confirmed against the DPDK advisory. Unknown.
Fixed in
- Upstream fix commit: 6ec17781346e0fe4b566b6bf8f79be71f87c10e4 (DPDK git)
- Debian 14: 25.11.4-1 (per OSV)
- Red Hat: Unknown.
- Ubuntu: Needs evaluation.
- Upstream DPDK fixed version: Unknown (unconfirmed reports mention < 25.11.4 and < 26.07).
Workaround
- No mitigation is currently available according to the CVE record and Red Hat.
- Possible risk reduction: remove or disable the VDUSE/vhost DPDK backend where it is not needed.
- Restrict which guests and containers can access the vhost backend.
Exploitation
- No evidence of exploitation in the wild found. Not listed in KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found for this CVE.
- Exploit price estimate of USD 0 to 5k (VulDB, rough figure).
Our recommendation
- Check whether DPDK packages (dpdk, grout) are installed on hypervisors and container hosts.
- If DPDK vhost with VDUSE is in use, restrict guest access to the vhost backend until a fixed version is installed.
- Apply the vendor update for your distribution as soon as it is available and verify the installed version.
- Monitor guests and hosts for unusual behaviour and crashes of DPDK processes.
- If DPDK is not installed, no action is required beyond normal patch management.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-86562 access.redhat.com
- Red Hat Bugzilla 2529667 bugzilla.redhat.com
- DPDK upstream fix commit git.dpdk.org
- OSV Debian record osv.dev
- Ubuntu CVE page ubuntu.com
- OpenCVE CVE-2026-86562 app.opencve.io
- Strix CVE-2026-86562 www.strix.ai
- VulDB 420133 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:56.
Original description (NVD)
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.