CVE-2026-86847: Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup
A flaw was found in DPDK lib/vhost vhost-crypto. preparewritebackdata() can fail after allocating a write-back node and before setting next to NULL. freewbdata() then recurses on an uninitialized next pointer, which can hang or crash the host vhost-crypto process.
Other sources
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
— MITRE
Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using DPDK lib/vhost with vhost-crypto and processing guest descriptor chains are exposed. The affected component is the host vhost-crypto process.
What does an attacker need to trigger the issue?
A guest must be able to cause guest descriptor mapping to fail during write-back data preparation. The failure must occur after a write-back node has been allocated but before its next pointer is initialized.
What is the practical impact?
Cleanup can follow an uninitialized next pointer, causing the host vhost-crypto process to enter an infinite loop or crash. The reported impact is availability loss for that process.