CVE-2026-86567: Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
A flaw was found in DPDK lib/vhost. The VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated. A worker thread can continue using dangling vring pointers after munmap(), leading to a crash or use-after-rebind.
Other sources
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
— MITRE
Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.11.8-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the DPDK lib/vhost VDUSE handler are exposed. The issue is specifically associated with vring pointer handling during IOTLB invalidation.
What conditions are required to trigger the flaw?
An IOTLB invalidation must occur while a worker thread can continue using vring pointers. The vulnerable path involves those pointers remaining usable after the underlying memory has been unmapped with munmap().
What impact can exploitation have?
The condition can cause a crash or a use-after-rebind situation. The reported severity metrics indicate high impacts to confidentiality, integrity, and availability.