CVE-2026-86562: Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)
A flaw was found in DPDK lib/vhost. A control-queue descriptor double-fetch in virtionetctrlpop() overflows the host heap in the VDUSE path. An incomplete fix in commit 6ec1778134 (January 2026) bounded descriptor indices but did not snapshot lengths.
Other sources
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
— MITRE
Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.11.8-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using DPDK lib/vhost through the VDUSE path are exposed. The vulnerable code is the VDUSE control-queue handler in virtio_net_ctrl_pop().
What level of access does an attacker need?
The CVSS vector indicates local attack access with low privileges and no user interaction. Exploitation involves a TOCTOU double-fetch of control-queue descriptors, allowing attacker-controlled content to overflow a host heap buffer.
Does the January 2026 change fully mitigate the issue?
No. Commit 6ec1778134 bounded descriptor indices but did not snapshot descriptor lengths, leaving the double-fetch condition that can lead to the heap overflow.