CVE-2026-86564: Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler
Published Sep 8, 2026
·Updated
A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
Other sources
A flaw was found in DPDK lib/vhost. The virtio-net control-queue handler reads commanddata without validating that the copied request is long enough. This out-of-bounds read can cause a host process crash under hardened allocators or sanitizers.
— Red Hat
Affected Software
1 affected component
DPDK lib/vhost
Event History
Sep 8, 2026
Data Sourced
via Red Hat·02:36 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·11:07 PM
Data Sourced
via MITRE·11:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability is rated as locally exploitable and requires low privileges. It does not require user interaction.
2
Does the reported impact include data disclosure or modification?
No confidentiality or integrity impact is indicated. The reported impact is limited to availability, specifically a possible host process crash.