CVE-2026-86566: Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
Other sources
A flaw was found in DPDK lib/vhost. Runt RX descriptors underflow the copy length in vhost enqueue on both split and packed rings. Unsigned subtraction underflow allows a full packet copy past a tiny descriptor window, which can crash a host vswitch such as OVS-DPDK.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Shared vhost backends using DPDK lib/vhost are affected, including host virtual switches such as OVS-DPDK. The impact is a denial of service through a crash of the host vSwitch.
What does an attacker need to do to trigger the failure?
An attacker needs control of a guest that can submit runt RX descriptors to the vhost enqueue path. The issue applies to both split-ring and packed-ring configurations.