CVE-2026-86848: Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
Other sources
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot still double-fetches srcdesc->next: it checks the index, then indexes the live guest table with a second read. A guest can change next after the check and force an out-of-bounds access. This is a remaining TOCTOU after CVE-2020-14375, not that ID.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Hosts using DPDK lib/vhost with the vhost-crypto backend and processing indirect descriptors from a guest are exposed. Exploitation is guest-triggered and affects the host backend.
What access does an attacker need?
An attacker needs privileges in a malicious guest sufficient to manipulate guest descriptor data. No user interaction is required, but exploitation requires local attack-vector access according to the supplied severity vector.
What is the impact of successful exploitation?
A malicious guest can alter a descriptor next index after it has been checked, causing an out-of-bounds access in the host backend. The supplied severity vector rates confidentiality, integrity, and availability impact as high, with scope changed.
Is this the same issue as CVE-2020-14375?
No. The issue is described as a remaining time-of-check/time-of-use condition after CVE-2020-14375, rather than CVE-2020-14375 itself.