DPDK vhost-crypto: Time-of-check/time-of-use race leads to out-of-bounds access
Summary
A race condition in the vhost-crypto component of DPDK (Data Plane Development Kit) lib/vhost double-fetches a guest descriptor index. A malicious guest with a virtio-crypto vhost-user device can trigger an out-of-bounds access in the host backend. Exploitation requires local access with a guest that is already attached to the vulnerable device, so the risk is mainly relevant for hypervisor, NFV and telco hosts that use DPDK vhost-crypto.
Affected
- DPDK lib/vhost vhost-crypto component
- Red Hat Fast Datapath for RHEL 8, 9 and 10 (listed as affected by Red Hat, versions not confirmed)
- Debian dpdk packages for Debian 12, 13 and 14 (per OSV, versions not confirmed)
- openSUSE dpdk packages (versions not confirmed)
Fixed in
- DPDK 25.11.4 upstream release notes list related fixes; mapping to this CVE unconfirmed
- DPDK 24.11.8 LTS, dated 2026-10-14, presumably contains the fix; changelog not confirmed
- Distribution fixed versions: Unknown.
Workaround
- Do not attach a virtio-crypto vhost-user backend to untrusted guests.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public exploit code identified at time of analysis.
Our recommendation
- Check whether DPDK with vhost-crypto is deployed on your hosts; if not, the preconditions do not apply.
- Do not attach virtio-crypto vhost-user backends to untrusted guests as an interim measure.
- Update DPDK or the distribution package to a fixed version once confirmed by your vendor, and apply the complete DPDK update.
- Verify fixed versions against the Red Hat, Debian and openSUSE advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-86848 access.redhat.com
- Red Hat Bugzilla 2529853 bugzilla.redhat.com
- OSV Debian CVE-2026-86848 osv.dev
- openSUSE SUSECVE-2026-86848 (Vulners) vulners.com
- DPDK 25.11 release notes doc.dpdk.org
- DPDK download page core.dpdk.org
- OpenCVE CVE-2026-86848 app.opencve.io
- vuln.today CWE-367 vuln.today
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:41.
Original description (NVD)
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.