RHSA-2026:94630
Vulnerability from csaf_redhat - Published: 2026-11-03 17:54 - Updated: 2026-11-09 09:53Summary
Red Hat Security Advisory: dpdk security update
Severity
Important
Notes
Topic: An update for dpdk is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.
Security Fix(es):
* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)
* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)
* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)
* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)
* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)
* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)
* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)
* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)
* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)
* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)
* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)
* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)
* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)
* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
6.5 (Medium)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
7.8 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Important
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
7.8 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Important
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
8.2 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Important
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
6.5 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
8.8 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Important
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
6.5 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
6.5 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
6.5 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
8.8 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Important
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
6.5 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
6.5 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
6.4 (Medium)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Moderate
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.
8.6 (High)
Affected products
Fixed
17 products, the same list as for
CVE-2026-86561
Threats
Impact
Important
References
74 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for dpdk is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.\n\nSecurity Fix(es):\n\n* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)\n\n* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)\n\n* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)\n\n* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)\n\n* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)\n\n* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)\n\n* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)\n\n* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)\n\n* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)\n\n* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)\n\n* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)\n\n* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)\n\n* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)\n\n* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:94630",
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2529666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529666"
},
{
"category": "external",
"summary": "2529667",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529667"
},
{
"category": "external",
"summary": "2529668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529668"
},
{
"category": "external",
"summary": "2529683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529683"
},
{
"category": "external",
"summary": "2529684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529684"
},
{
"category": "external",
"summary": "2529685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529685"
},
{
"category": "external",
"summary": "2529844",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529844"
},
{
"category": "external",
"summary": "2529846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529846"
},
{
"category": "external",
"summary": "2529847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529847"
},
{
"category": "external",
"summary": "2529853",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529853"
},
{
"category": "external",
"summary": "2529858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529858"
},
{
"category": "external",
"summary": "2529897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529897"
},
{
"category": "external",
"summary": "2537015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537015"
},
{
"category": "external",
"summary": "2541488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541488"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94630.json"
}
],
"title": "Red Hat Security Advisory: dpdk security update",
"tracking": {
"current_release_date": "2026-11-09T09:53:23+00:00",
"generator": {
"date": "2026-11-09T09:53:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:94630",
"initial_release_date": "2026-11-03T17:54:39+00:00",
"revision_history": [
{
"date": "2026-11-03T17:54:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-03T17:54:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-09T09:53:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "dpdk-2:25.11-2.el10_2.src",
"product": {
"name": "dpdk-2:25.11-2.el10_2.src",
"product_id": "dpdk-2:25.11-2.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk@25.11-2.el10_2?arch=src\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "dpdk-2:25.11-2.el10_2.aarch64",
"product": {
"name": "dpdk-2:25.11-2.el10_2.aarch64",
"product_id": "dpdk-2:25.11-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk@25.11-2.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-devel-2:25.11-2.el10_2.aarch64",
"product": {
"name": "dpdk-devel-2:25.11-2.el10_2.aarch64",
"product_id": "dpdk-devel-2:25.11-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-devel@25.11-2.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-tools-2:25.11-2.el10_2.aarch64",
"product": {
"name": "dpdk-tools-2:25.11-2.el10_2.aarch64",
"product_id": "dpdk-tools-2:25.11-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-tools@25.11-2.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"product": {
"name": "dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"product_id": "dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-debugsource@25.11-2.el10_2?arch=aarch64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"product": {
"name": "dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"product_id": "dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-debuginfo@25.11-2.el10_2?arch=aarch64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "dpdk-2:25.11-2.el10_2.ppc64le",
"product": {
"name": "dpdk-2:25.11-2.el10_2.ppc64le",
"product_id": "dpdk-2:25.11-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk@25.11-2.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-devel-2:25.11-2.el10_2.ppc64le",
"product": {
"name": "dpdk-devel-2:25.11-2.el10_2.ppc64le",
"product_id": "dpdk-devel-2:25.11-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-devel@25.11-2.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-tools-2:25.11-2.el10_2.ppc64le",
"product": {
"name": "dpdk-tools-2:25.11-2.el10_2.ppc64le",
"product_id": "dpdk-tools-2:25.11-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-tools@25.11-2.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"product": {
"name": "dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"product_id": "dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-debugsource@25.11-2.el10_2?arch=ppc64le\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"product": {
"name": "dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"product_id": "dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-debuginfo@25.11-2.el10_2?arch=ppc64le\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "dpdk-2:25.11-2.el10_2.x86_64",
"product": {
"name": "dpdk-2:25.11-2.el10_2.x86_64",
"product_id": "dpdk-2:25.11-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk@25.11-2.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-devel-2:25.11-2.el10_2.x86_64",
"product": {
"name": "dpdk-devel-2:25.11-2.el10_2.x86_64",
"product_id": "dpdk-devel-2:25.11-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-devel@25.11-2.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-tools-2:25.11-2.el10_2.x86_64",
"product": {
"name": "dpdk-tools-2:25.11-2.el10_2.x86_64",
"product_id": "dpdk-tools-2:25.11-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-tools@25.11-2.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"product": {
"name": "dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"product_id": "dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-debugsource@25.11-2.el10_2?arch=x86_64\u0026epoch=2"
}
}
},
{
"category": "product_version",
"name": "dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"product": {
"name": "dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"product_id": "dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-debuginfo@25.11-2.el10_2?arch=x86_64\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "dpdk-doc-2:25.11-2.el10_2.noarch",
"product": {
"name": "dpdk-doc-2:25.11-2.el10_2.noarch",
"product_id": "dpdk-doc-2:25.11-2.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dpdk-doc@25.11-2.el10_2?arch=noarch\u0026epoch=2"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64"
},
"product_reference": "dpdk-2:25.11-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le"
},
"product_reference": "dpdk-2:25.11-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-2:25.11-2.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src"
},
"product_reference": "dpdk-2:25.11-2.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64"
},
"product_reference": "dpdk-2:25.11-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-debuginfo-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64"
},
"product_reference": "dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-debuginfo-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le"
},
"product_reference": "dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-debuginfo-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64"
},
"product_reference": "dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-debugsource-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64"
},
"product_reference": "dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-debugsource-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le"
},
"product_reference": "dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-debugsource-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64"
},
"product_reference": "dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-devel-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64"
},
"product_reference": "dpdk-devel-2:25.11-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-devel-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le"
},
"product_reference": "dpdk-devel-2:25.11-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-devel-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64"
},
"product_reference": "dpdk-devel-2:25.11-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-doc-2:25.11-2.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch"
},
"product_reference": "dpdk-doc-2:25.11-2.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-tools-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64"
},
"product_reference": "dpdk-tools-2:25.11-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-tools-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le"
},
"product_reference": "dpdk-tools-2:25.11-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dpdk-tools-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
},
"product_reference": "dpdk-tools-2:25.11-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ivar Al-Safawi"
]
}
],
"cve": "CVE-2026-86561",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-08T01:51:17.640000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529666"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious guest that can control vhost-user memory table messages can trigger this flaw. Red Hat has rated this as having a security impact of Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86561"
},
{
"category": "external",
"summary": "RHBZ#2529666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529666"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86561"
}
],
"release_date": "2026-10-14T15:00:10.164689+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "No mitigation is currently available.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup"
},
{
"acknowledgments": [
{
"names": [
"Ivar Al-Safawi"
]
}
],
"cve": "CVE-2026-86562",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization"
},
"discovery_date": "2026-09-08T02:13:15.727000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529667"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious guest with access to the VDUSE control virtqueue can trigger this flaw. Red Hat has rated this as having a security impact of Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86562"
},
{
"category": "external",
"summary": "RHBZ#2529667",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529667"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86562"
},
{
"category": "external",
"summary": "https://git.dpdk.org/dpdk/commit/?id=6ec17781346e0fe4b566b6bf8f79be71f87c10e4",
"url": "https://git.dpdk.org/dpdk/commit/?id=6ec17781346e0fe4b566b6bf8f79be71f87c10e4"
}
],
"release_date": "2026-10-14T15:00:19.257378+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "No mitigation is currently available.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)"
},
{
"acknowledgments": [
{
"names": [
"Ivar Al-Safawi"
]
}
],
"cve": "CVE-2026-86563",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-09-08T02:25:10.743000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529668"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Double offset bug in vhost log mapping calculation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious guest that can control vhost-user log mapping can trigger this flaw. Red Hat has rated this as having a security impact of Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86563"
},
{
"category": "external",
"summary": "RHBZ#2529668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529668"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86563"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86563",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86563"
}
],
"release_date": "2026-10-14T15:00:39.825246+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "No mitigation is currently available.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dpdk: dpdk: Double offset bug in vhost log mapping calculation"
},
{
"cve": "CVE-2026-86565",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-08T02:36:36.580000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529683"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious guest with a vhost-user-blk or vhost-user-scsi device using the inflight feature can trigger this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86565"
},
{
"category": "external",
"summary": "RHBZ#2529683",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529683"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86565"
}
],
"release_date": "2026-10-14T15:00:48.780149+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "No mitigation is currently available.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write"
},
{
"acknowledgments": [
{
"names": [
"Arthur Chan"
],
"organization": "Ada Logics"
},
{
"names": [
"Anthropic Research"
]
}
],
"cve": "CVE-2026-86566",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-09-08T02:43:12.699000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious guest with a vhost-user network device can trigger this flaw. Red Hat has rated this as having a security impact of Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86566"
},
{
"category": "external",
"summary": "RHBZ#2529684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86566"
}
],
"release_date": "2026-10-14T15:00:56.647925+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings)"
},
{
"acknowledgments": [
{
"names": [
"Ivar Al-Safawi"
]
}
],
"cve": "CVE-2026-86567",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-08T02:48:46.769000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A malicious VM with a VDUSE device can trigger this flaw via memory hot-remove, balloon inflation, or an IOMMU mapping change. Red Hat has rated this as having a security impact of Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86567"
},
{
"category": "external",
"summary": "RHBZ#2529685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86567"
}
],
"release_date": "2026-10-14T15:01:08.808479+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "No mitigation is currently available.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap"
},
{
"acknowledgments": [
{
"names": [
"Anthropic Research"
]
}
],
"cve": "CVE-2026-86845",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-08T12:39:30.106000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529844"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A guest with a virtio-crypto vhost-user device can trigger this flaw. Red Hat has rated this as having a security impact of Moderate. Product impact depends on whether vhost-crypto is built and enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86845"
},
{
"category": "external",
"summary": "RHBZ#2529844",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529844"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86845",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86845"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86845",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86845"
}
],
"release_date": "2026-10-14T15:01:17.409510+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Do not attach a virtio-crypto vhost-user backend to untrusted guests.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup"
},
{
"acknowledgments": [
{
"names": [
"Anthropic Research"
]
}
],
"cve": "CVE-2026-86846",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-08T14:44:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529846"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A guest with a virtio-crypto vhost-user device can trigger this flaw. Red Hat has rated this as having a security impact of Moderate. Product impact depends on whether vhost-crypto is built and enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86846"
},
{
"category": "external",
"summary": "RHBZ#2529846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86846"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86846",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86846"
}
],
"release_date": "2026-10-14T15:01:43.554477+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Do not attach a virtio-crypto vhost-user backend to untrusted guests.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto"
},
{
"acknowledgments": [
{
"names": [
"Anthropic Research"
]
}
],
"cve": "CVE-2026-86847",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-09-08T14:46:50.621000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A guest with a virtio-crypto vhost-user device can trigger this flaw. Red Hat has rated this as having a security impact of Moderate. Product impact depends on whether vhost-crypto is built and enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86847"
},
{
"category": "external",
"summary": "RHBZ#2529847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86847",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86847"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86847",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86847"
}
],
"release_date": "2026-10-14T15:01:54.300065+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Do not attach a virtio-crypto vhost-user backend to untrusted guests.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup"
},
{
"cve": "CVE-2026-86848",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-09-08T14:49:04.382000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529853"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A guest with a virtio-crypto vhost-user device can trigger this flaw. Red Hat has rated this as having a security impact of Important. Product impact depends on whether vhost-crypto is built and enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86848"
},
{
"category": "external",
"summary": "RHBZ#2529853",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529853"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86848"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86848",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86848"
}
],
"release_date": "2026-10-14T15:02:01.496813+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Do not attach a virtio-crypto vhost-user backend to untrusted guests.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto"
},
{
"cve": "CVE-2026-86849",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-08T14:50:45.987000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529858"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A guest with a virtio-crypto vhost-user device can trigger this flaw. Red Hat has rated this as having a security impact of Moderate. Product impact depends on whether vhost-crypto is built and enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86849"
},
{
"category": "external",
"summary": "RHBZ#2529858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529858"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86849",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86849"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86849",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86849"
}
],
"release_date": "2026-10-14T15:02:10.152199+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Do not attach a virtio-crypto vhost-user backend to untrusted guests.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto"
},
{
"acknowledgments": [
{
"names": [
"Anthropic Research"
]
}
],
"cve": "CVE-2026-86856",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-08T15:37:20.220000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529897"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the DPDK nfp vDPA driver in DPDK 24.11 and later. No fixed version is available yet (patches are under review). The nfp vDPA PMD was introduced in DPDK 23.11; confirm whether 23.11 LTS is also affected before marking that stream not affected. A guest with access to an NFP vDPA device (class=vdpa) can trigger the overflow. Red Hat has rated this as having a security impact of Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86856"
},
{
"category": "external",
"summary": "RHBZ#2529897",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529897"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86856"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86856",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86856"
}
],
"release_date": "2026-10-14T15:02:25.357919+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted guests to an NFP VF running with class=vdpa.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver"
},
{
"acknowledgments": [
{
"names": [
"Naseeb Dangi",
"Xiang Li"
],
"organization": "AOSP Lab @Nankai University"
}
],
"cve": "CVE-2026-93683",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-09-18T14:13:34.245000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2537015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in the DPDK vhost library allows a malicious guest to cause a denial of service on the host vhost process. By manipulating the virtio indirect descriptor table length, a guest can trigger an out-of-bounds memory access, leading to a crash or disruption of the vhost process. This issue requires a compromised guest to exploit.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93683"
},
{
"category": "external",
"summary": "RHBZ#2537015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93683"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93683",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93683"
}
],
"release_date": "2026-10-14T15:03:08.668174+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU"
},
{
"acknowledgments": [
{
"names": [
"Alexandru-Ionut Jipa"
]
}
],
"cve": "CVE-2026-100236",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-25T15:53:18.636000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541488"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dpdk: dpdk: heap out-of-bounds read/write in GSO header copy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity because an unauthenticated remote attacker or guest virtual machine can cause heap memory corruption, leading to a process crash or potential code execution without requiring elevated privileges. The flaw affects environments using Data Plane Development Kit (DPDK) applications where software Generic Segmentation Offload (GSO) processes packets from untrusted network sources or guest interfaces. Workloads that do not utilize software GSO or rely entirely on hardware-based segmentation offloading are not impacted by this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100236"
},
{
"category": "external",
"summary": "RHBZ#2541488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541488"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100236"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100236",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100236"
}
],
"release_date": "2026-10-14T15:03:23.201507+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T17:54:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94630"
},
{
"category": "workaround",
"details": "Do not run software GSO (rte_gso_segment / testpmd --enable-gso) on untrusted packets. Size direct_pool larger than the max header (~208 B tunneled). That does not fully cover the short-first-segment over-read.",
"product_ids": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.src",
"AppStream-10.2.Z:dpdk-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debuginfo-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-debugsource-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-devel-2:25.11-2.el10_2.x86_64",
"AppStream-10.2.Z:dpdk-doc-2:25.11-2.el10_2.noarch",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.aarch64",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.ppc64le",
"AppStream-10.2.Z:dpdk-tools-2:25.11-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dpdk: dpdk: heap out-of-bounds read/write in GSO header copy"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.