DPDK: Out-of-bounds write in vhost library via guest virtqueue desynchronization
Summary
A flaw in the lib/vhost component of DPDK (Data Plane Development Kit) allows a guest to desynchronize the virtqueue size from the inflight descriptor table size. This causes an out-of-bounds write in the host vhost process. The attack requires a malicious guest with a vhost-user-blk or vhost-user-scsi device that uses the inflight feature; a successful attack could affect the confidentiality, integrity and availability of the host. Red Hat rates the CVSS 3.1 base score at 8.2 (High), but no vendor fix or mitigation is available yet.
Affected
- Red Hat Fast Datapath for RHEL 8 (all listed releases, per CNA record)
- Red Hat Fast Datapath for RHEL 9 (all listed releases, per CNA record)
- Red Hat Fast Datapath for RHEL 10 (all listed releases, per CNA record)
- Other DPDK versions: Unknown.
Fixed in
Unknown.
Workaround
No mitigation is currently available.
- Check whether vhost-user-blk or vhost-user-scsi devices with the inflight feature are in use.
Exploitation
- No public exploitation or proof of concept known.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether DPDK vhost (vhost-user) is used on your hosts, especially in NFV, OVS-DPDK or multi-tenant environments.
- Limit guests on such hosts to trusted workloads until a fix is available.
- Monitor the Red Hat Fast Datapath errata and apply the update as soon as it is released.
- Re-check the status once NVD analysis and upstream DPDK fix versions are published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-86565 access.redhat.com
- Red Hat Bugzilla 2529683 bugzilla.redhat.com
- OpenCVE CVE-2026-86565 app.opencve.io
- Ubuntu security CVE-2026-86565 ubuntu.com
- OSV Debian CVE-2026-86565 osv.dev
- VulnCheck enrichment CVE-2026-86565 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:18.
Original description (NVD)
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.