DPDK vhost library: Incorrect memory access in vhost log mapping calculation
Summary
A double-offset bug in the vhost log mapping calculation of the DPDK lib/vhost component can lead to incorrect memory access. According to Red Hat, a malicious guest that can control the vhost-user log mapping can trigger the flaw. Red Hat rates the impact as Important, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected
- Red Hat Fast Datapath for RHEL 8, 9 and 10 (listed as affected in the CVE record)
- Upstream DPDK version range: Unknown.
Fixed in
- Red Hat: Unknown. Check the Red Hat CVE page and Bugzilla entry.
- Debian 13 (trixie): dpdk 24.11.8-0+deb13u1 according to DSA-6597-1 (third-party sources, not verified against the Debian tracker).
- Upstream fix commit: Unknown.
Workaround
No mitigation is currently available according to Red Hat.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- VulDB: no exploit available.
- No public proof of concept or evidence of exploitation in the wild was found.
Our recommendation
- Identify hosts running DPDK with vhost-user, such as NFV, OpenStack, OpenShift or OVS-DPDK setups.
- Apply the vendor update for your distribution as soon as it is available (Red Hat, Debian, SUSE or Ubuntu).
- Until a patch is installed, restrict which guests can access vhost-user sockets and limit guest tenants to trusted workloads.
- Monitor vendor advisories for the fixed package versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE-2026-86563 access.redhat.com
- Red Hat Bugzilla 2529668 bugzilla.redhat.com
- Ubuntu CVE-2026-86563 ubuntu.com
- Debian Security Advisories www.debian.org
- VulDB 420134 vuldb.com
- OpenCVE CVE-2026-86563 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:57.
Original description (NVD)
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.