DPDK: Use-after-free in VDUSE handler of lib/vhost
Summary
A flaw in the VDUSE handler of DPDK lib/vhost fails to invalidate vring pointers when the IOTLB is invalidated, which leads to a use-after-free (CWE-416). A malicious virtual machine with a VDUSE device can trigger it through memory hot-remove, balloon inflation or an IOMMU mapping change, which may affect confidentiality, integrity and availability. Exploitation requires local access with low privileges on a host that uses DPDK with VDUSE. Red Hat rates the security impact as Important.
Affected
- Red Hat Fast Datapath for RHEL 8, 9 and 10 (per CVE record; the product list differs between sources, verify before relying on it)
- Affected version ranges: Unknown.
Fixed in
- Red Hat fixed package versions: Unknown. No Red Hat errata confirmed.
- Upstream DPDK: fixed in 25.11.4.
- Debian dpdk package: fixed in 25.11.4-1 (per OSV).
Workaround
- No mitigation is currently available.
Exploitation
- Not listed in the CISA KEV catalog.
- No public exploit code known.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether DPDK, vDPA or VDUSE is used on your hosts, for example in OpenShift, OpenStack or NFV environments.
- Restrict local access to affected hosts and limit which virtual machines can use VDUSE devices.
- Apply the DPDK update from your distributor as soon as it is available and confirm it against the Red Hat errata.
- Monitor the Red Hat CVE page for status changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-86567 access.redhat.com
- Red Hat Bugzilla 2529685 bugzilla.redhat.com
- DPDK 25.11 release notes doc.dpdk.org
- OSV Debian entry CVE-2026-86567 osv.dev
- Ubuntu security tracker CVE-2026-86567 ubuntu.com
- VulDB CVE-2026-86567 vuldb.com
- Azure Linux pull request 19476 github.com
- OpenCVE CVE-2026-86567 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:42.
Original description (NVD)
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.