CVE-2026-86845: Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
Other sources
A flaw was found in DPDK lib/vhost vhost-crypto. vhostcryptoclosesess() frees a cryptodev session without invalidating the per-device session cache, so a later request with the same session id uses a dangling pointer. The data path also attaches vhostsession->sym or vhostsession->asym without checking the session type, so an asymmetric session can be treated as symmetric.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployment component is affected?
The affected component is the host-side DPDK vhost-crypto backend in lib/vhost. The flaw is triggered through vhost-crypto session handling and can affect hosts that process those session requests.
What does an attacker need to do to trigger the issue?
The attacker needs low-privileged local access and does not require user interaction. Exploitation involves closing a cryptodev session and later sending a request using the same session ID, causing use of the stale cached pointer; an asymmetric session may also be attached as though it were symmetric.
What is the expected security impact?
The reported impact is high availability impact, with no reported confidentiality or integrity impact. The stale pointer can result in use-after-free or type-confusion behavior in the host vhost-crypto backend.