CVE-2026-86846: Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto
Published Sep 8, 2026
·Updated
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
Other sources
A flaw was found in DPDK lib/vhost vhost-crypto. rtevhostcryptofetchrequests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhostcryptofinalizeonerequest() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.
— Red Hat
Affected Software
1 affected component
DPDK vhost-crypto
Event History
Sep 8, 2026
Data Sourced
via Red Hat·02:48 PM
DescriptionSeverityAffected Software
Oct 14, 2026
CVE Published
via MITRE·05:52 PM
Data Sourced
via MITRE·05:52 PM
DescriptionSeverityWeakness