{"id":"CVE-2026-86845","aliases":["ALSA-2026:94629","ALSA-2026:94630","ALSA-2026:96083","DEBIAN-CVE-2026-86845","EUVD-2026-101509","GHSA-7ww6-vqp6-25qm","RLSA-2026:94629","RLSA-2026:94630","RLSA-2026:96083","RLSA-2026:98505","SUSE-SU-2026:5135-1","SUSE-SU-2026:5184-1","UBUNTU-CVE-2026-86845","openSUSE-SU-2026:12151-1"],"status":"published","title":"Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00166,"percentile":0.0592,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-825"],"published":"2026-10-14T17:52:06Z","modified":"2026-11-12T00:30:02Z","fixes":[{"ecosystem":"Debian:13","package":"dpdk","fixed_in":["24.11.8-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dpdk","fixed_in":["25.11.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el9_8"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dpdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el9_8"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dpdk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el9_8"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:9","package":"dpdk-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el9_8"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el10_2"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dpdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el10_2"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dpdk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el10_2"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:10","package":"dpdk-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el10_2"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11-3.el8_10"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dpdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11-3.el8_10"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dpdk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11-3.el8_10"}]}],"bundled":14},{"source":"osv","ecosystem":"AlmaLinux:8","package":"dpdk-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11-3.el8_10"}]}],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.11.1-2","22.11.11-0+deb12u1","22.11.2-1","22.11.2-2","22.11.2-2~deb12u1","22.11.2-3","22.11.3-1","22.11.3-1~deb12u1","22.11.3-2","22.11.4-1~deb12u1","22.11.5-1~deb12u1","22.11.6-1~deb12u1","22.11.7-1~deb12u1","22.11.8-1~deb12u1","22.11.9-1~deb12u1","23.11-1","23.11-1~exp1","23.11.1-1","23.11.1-2","23.11.2-1","23.11.2-1+exp1","23.11.2-1+exp2","23.11.2-1+exp3","23.11.2-1+exp4","23.11.2-2","23.11.2-3","24.11-1","24.11-2","24.11.1-1","24.11.2-1","24.11.2-2","24.11.3-1","24.11.3-1~deb13u1","24.11.3-2","24.11~rc2-1","24.11~rc2-2","24.11~rc3-1","24.11~rc4-1","25.11-1","25.11-2","25.11.1-1","25.11.2-1","25.11.3-1","25.11.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.8-0+deb13u1"}]}],"versions":["24.11.2-2","24.11.3-1","24.11.3-1~deb13u1","24.11.3-2","24.11.4-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.11.4-1"}]}],"versions":["24.11.2-2","24.11.3-1","24.11.3-1~deb13u1","24.11.3-2","25.11-1","25.11-2","25.11.1-1","25.11.2-1","25.11.3-1"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el9_8"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el10_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:8","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.11-3.el8_10"}]}],"bundled":14},{"source":"osv","ecosystem":"Rocky Linux:9","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:25.11-2.el9_8"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"dpdk22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"dpdk22-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dpdk22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dpdk22-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dpdk22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dpdk22-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dpdk22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dpdk22-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dpdk22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150500.5.16.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150600.3.21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dpdk-thunderx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150600.3.21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.11.11-150600.3.21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-0ubuntu1","2.0.0-0ubuntu2","2.0.0-0ubuntu3","2.2.0-0ubuntu1","2.2.0-0ubuntu3","2.2.0-0ubuntu5","2.2.0-0ubuntu6","2.2.0-0ubuntu7","2.2.0-0ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.05.2-0ubuntu1","17.05.2-0ubuntu2","17.11-3","17.11-4","17.11-5","17.11.1-6","17.11.2-1ubuntu0.1","17.11.3-3~ubuntu0.18.04","17.11.5-0~ubuntu18.04.1","17.11.6-0~ubuntu18.04.1","17.11.8-0~ubuntu18.04.2","17.11.9-0ubuntu18.04.1","17.11.9-0ubuntu18.04.2","17.11.10-0ubuntu0.1","17.11.10-0ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.11.2-4","18.11.3-1","18.11.4-1","18.11.4-1ubuntu1","18.11.5-1","19.11-2ubuntu1","19.11-2ubuntu2","19.11.1-0ubuntu1","19.11.1-0ubuntu1.1","19.11.3-0ubuntu0.1","19.11.3-0ubuntu0.2","19.11.6-0ubuntu0.20.04.1","19.11.7-0ubuntu0.20.04.1","19.11.7-0ubuntu0.20.04.2","19.11.10-0ubuntu0.20.04.1","19.11.12-0ubuntu0.20.04.1","19.11.13-0ubuntu0.20.04.1","19.11.14-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.11.3-0ubuntu1","20.11.3-0ubuntu3","21.11-1","21.11-1build1","21.11.1-0ubuntu0.3","21.11.2-0ubuntu0.22.04.1","21.11.3-0ubuntu0.22.04.1","21.11.4-0ubuntu0.22.04.1","21.11.6-0ubuntu0.22.04.1","21.11.6-0ubuntu0.22.04.2","21.11.9-0ubuntu0.22.04.1","21.11.9-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.11.3-1","22.11.3-2","23.11-1","23.11-1build2","23.11-1build3","23.11-1ubuntu0.1","23.11.4-0ubuntu0.24.04.1","23.11.4-0ubuntu0.24.04.2","23.11.7-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.11-2","25.11.2-1","25.11.2-1build1","25.11.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.11.3-1","24.11.3-2","25.11-2","25.11.3-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dpdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.11.4-1.1"}]}],"bundled":14}],"products":[{"vendor":"red hat","product":"fast datapath for rhel 10"},{"vendor":"red hat","product":"fast datapath for rhel 8"},{"vendor":"red hat","product":"fast datapath for rhel 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:94629","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94630","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96083","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98505","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98616","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86845","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529844","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86845"},{"url":"https://github.com/advisories/GHSA-7ww6-vqp6-25qm"},{"url":"https://access.redhat.com/security/cve/CVE-2026-100236","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86561","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86562","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86563","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86565","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86566","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86567","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86846","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86848","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86849","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93683","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529666","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529667","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529668","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529683","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529684","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529685","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529844","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529846","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529847","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529853","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529858","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2537015","tags":["report"]},{"url":"https://bugzilla.redhat.com/2541488","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-94629.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-94630.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-96083.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-86845","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94629","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541488","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:94630","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96083","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98505","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265135-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285657","tags":["report"]},{"url":"https://bugzilla.suse.com/1285658","tags":["report"]},{"url":"https://bugzilla.suse.com/1285659","tags":["report"]},{"url":"https://bugzilla.suse.com/1285660","tags":["report"]},{"url":"https://bugzilla.suse.com/1285663","tags":["report"]},{"url":"https://bugzilla.suse.com/1285664","tags":["report"]},{"url":"https://bugzilla.suse.com/1285666","tags":["report"]},{"url":"https://bugzilla.suse.com/1285671","tags":["report"]},{"url":"https://bugzilla.suse.com/1285672","tags":["report"]},{"url":"https://bugzilla.suse.com/1285676","tags":["report"]},{"url":"https://bugzilla.suse.com/1285678","tags":["report"]},{"url":"https://bugzilla.suse.com/1285679","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93683","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265184-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-86845","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86845","tags":["report"]},{"url":"https://bugs.dpdk.org/show_bug.cgi?id=2028","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/14/7","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86567","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-86845","title":"Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","status":"published","published":"2026-10-14T17:52:06.749Z","modified":"2026-11-11T13:54:09.047Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-825"],"updated_at":"2026-11-11T14:28:43.346708Z"}],"euvd":[{"id":"EUVD-2026-101509","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","status":"published","published":"2026-10-14T17:52:06Z","modified":"2026-11-11T13:54:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T15:29:13.297281Z"}],"ghsa":[{"id":"GHSA-7ww6-vqp6-25qm","title":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session...","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","status":"published","published":"2026-10-14T18:32:29Z","modified":"2026-11-11T15:31:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-825"],"updated_at":"2026-11-11T15:34:48.112751Z"}],"nvd":[{"id":"CVE-2026-86845","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","status":"published","published":"2026-10-14T18:19:18.677Z","modified":"2026-11-11T14:17:49.11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-825"],"updated_at":"2026-11-11T15:25:15.389278Z"}],"osv":[{"id":"DEBIAN-CVE-2026-86845","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","status":"published","published":"2026-10-14T18:19:18.677Z","modified":"2026-11-10T09:47:45.064451285Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T10:26:30.347596Z"},{"id":"RLSA-2026:94629","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.\n\nSecurity Fix(es):\n\n* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n\n* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n\n* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n\n* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n\n* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n\n* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n\n* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n\n* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n\n* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n\n* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n\n* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n\n* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n\n* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n\n* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-04T09:06:07.045237Z","modified":"2026-11-04T09:45:03.414939144Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"RLSA-2026:94630","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.\n\nSecurity Fix(es):\n\n* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n\n* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n\n* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n\n* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n\n* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n\n* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n\n* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n\n* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n\n* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n\n* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n\n* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n\n* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n\n* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n\n* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-04T09:10:56.529723Z","modified":"2026-11-04T09:45:02.462674843Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T10:05:57.467041Z"},{"id":"RLSA-2026:96083","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.\n\nSecurity Fix(es):\n\n* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n\n* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n\n* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n\n* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n\n* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n\n* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n\n* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n\n* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n\n* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n\n* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n\n* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n\n* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n\n* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n\n* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:01:32.688652Z","modified":"2026-11-10T12:30:03.473582117Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"RLSA-2026:98505","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.\n\nSecurity Fix(es):\n\n* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n\n* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n\n* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n\n* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n\n* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n\n* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n\n* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n\n* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n\n* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n\n* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n\n* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n\n* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n\n* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n\n* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:02.564021105Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-86845","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","status":"published","published":"2026-10-14T18:19:00Z","modified":"2026-10-29T02:37:55.691664446Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:94629","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.  \n\nSecurity Fix(es):  \n\n  * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n  * dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n  * dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n  * dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n  * dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n  * dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n  * dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n  * dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n  * dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n  * dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n  * dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n  * dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n  * dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n  * dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-05T00:00:02.262039838Z","updated_at":"2026-11-05T00:11:21.164934Z"},{"id":"ALSA-2026:94630","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.  \n\nSecurity Fix(es):  \n\n  * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n  * dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n  * dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n  * dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n  * dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n  * dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n  * dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n  * dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n  * dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n  * dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n  * dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n  * dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n  * dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n  * dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T16:45:03.651599003Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"ALSA-2026:96083","title":"Important: dpdk security update","description":"The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.  \n\nSecurity Fix(es):  \n\n  * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n  * dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n  * dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n  * dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n  * dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n  * dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n  * dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n  * dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n  * dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n  * dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n  * dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n  * dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n  * dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n  * dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:00:02.574770809Z","updated_at":"2026-11-09T15:32:21.787252Z"},{"id":"openSUSE-SU-2026:12151-1","title":"dpdk-25.11.4-1.1 on GA media","description":"These are all security issues fixed in the dpdk-25.11.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-17T10:00:05.085036278Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:5135-1","title":"Security update for dpdk22","description":"This update for dpdk22 fixes the following issues:\n\n- CVE-2026-86561: missing memory size validation before mmap in vhost memory region setup (bsc#1285678).\n- CVE-2026-86563: double offset bug in vhost log mapping calculation (bsc#1285676).\n- CVE-2026-86565: split-ring inflight descriptor table overflow (bsc#1285672).\n- CVE-2026-86566: copy length underflow in vhost enqueue (bsc#1285671).\n- CVE-2026-86845: use-after-free and type confusion in vhost-crypto session handling (bsc#1285666).\n- CVE-2026-86846: vhost-crypto TOCTOU out-of-bounds write in finalize path (bsc#1285664).\n- CVE-2026-86847: infinite cleanup loop in vhost-crypto writeback chain (bsc#1285663).\n- CVE-2026-86848: vhost-crypto TOCTOU out-of-bounds write in finalize path (bsc#1285657).\n- CVE-2026-86849: integer overflow and missing validation in vhost-crypto request handling (bsc#1285658).\n- CVE-2026-86856: stack and heap buffer overflow in nfp vDPA driver (bsc#1285659).\n- CVE-2026-93683: indirect descriptor table double-fetch (bsc#1285660).\n- CVE-2026-100236: GSO library heap out-of-bounds read/write with small mbuf pools (bsc#1285679).\n","status":"published","published":"2026-11-09T12:56:28Z","modified":"2026-11-10T13:15:10.656423856Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"SUSE-SU-2026:5184-1","title":"Security update for dpdk","description":"This update for dpdk fixes the following issues:\n\n- CVE-2026-86561: missing memory size validation before mmap in vhost memory region setup (bsc#1285678).\n- CVE-2026-86563: double offset bug in vhost log mapping calculation (bsc#1285676).\n- CVE-2026-86565: split-ring inflight descriptor table overflow (bsc#1285672).\n- CVE-2026-86566: copy length underflow in vhost enqueue (bsc#1285671).\n- CVE-2026-86845: use-after-free and type confusion in vhost-crypto session handling (bsc#1285666).\n- CVE-2026-86846: vhost-crypto TOCTOU out-of-bounds write in finalize path (bsc#1285664).\n- CVE-2026-86847: infinite cleanup loop in vhost-crypto writeback chain (bsc#1285663).\n- CVE-2026-86848: vhost-crypto TOCTOU out-of-bounds write in finalize path (bsc#1285657).\n- CVE-2026-86849: integer overflow and missing validation in vhost-crypto request handling (bsc#1285658).\n- CVE-2026-86856: stack and heap buffer overflow in nfp vDPA driver (bsc#1285659).\n- CVE-2026-93683: indirect descriptor table double-fetch (bsc#1285660).\n- CVE-2026-100236: GSO library heap out-of-bounds read/write with small mbuf pools (bsc#1285679).\n","status":"published","published":"2026-11-10T17:43:09Z","modified":"2026-11-11T13:00:05.6160697Z","updated_at":"2026-11-11T13:08:46.301371Z"}]}}