CVE-2026-86846: Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
Other sources
A flaw was found in DPDK lib/vhost vhost-crypto. rtevhostcryptofetchrequests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhostcryptofinalizeonerequest() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts running the DPDK lib/vhost vhost-crypto backend are exposed if they process requests from a guest. The vulnerable code is in the host backend, while the guest supplies the malformed avail-ring descriptor index.
What access does an attacker need to exploit it?
An attacker needs the ability to control a guest that can submit requests to the affected vhost-crypto backend. No user interaction is required.
What is the impact on the host?
A malicious guest can cause an out-of-bounds write in the host vhost-crypto backend. The reported impact is denial of service; confidentiality and integrity impacts are not listed.