CVE-2026-86566: Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

Published Sep 8, 2026

Updated

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

Other sources

A flaw was found in DPDK lib/vhost. Runt RX descriptors underflow the copy length in vhost enqueue on both split and packed rings. Unsigned subtraction underflow allows a full packet copy past a tiny descriptor window, which can crash a host vswitch such as OVS-DPDK.

— Red Hat

Affected Software

1 affected component

DPDK lib/vhost

Event History

Sep 8, 2026

Data Sourced

via Red Hat·02:47 AM

DescriptionSeverityAffected Software

Oct 14, 2026

CVE Published

via MITRE·05:52 PM

Data Sourced

via MITRE·05:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Shared vhost backends using DPDK lib/vhost are affected, including host virtual switches such as OVS-DPDK. The impact is a denial of service through a crash of the host vSwitch.

What does an attacker need to do to trigger the failure?

An attacker needs control of a guest that can submit runt RX descriptors to the vhost enqueue path. The issue applies to both split-ring and packed-ring configurations.

CVE-2026-86566: Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

Other sources

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger the failure?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger the failure?