CVE-2026-86849: Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
Other sources
A flaw was found in DPDK lib/vhost vhost-crypto. vhostcryptocheckchainrequest() adds uint32t length fields without overflow checks, so a wrapped sum can pass the cap while preparewritebackdata() still uses the original dstdatalen. writebackdata() then memcpy/memset that length from a host mbuf. The RSA request path has no equivalent length cap.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The vulnerability is rated AV:L and PR:L, indicating an attacker needs local access and low privileges. No user interaction is required.
What is the expected security impact?
The CVSS vector indicates high availability impact, with no confidentiality or integrity impact scored. The scope is marked as changed.
Which request handling paths are implicated?
The chain-length validation can be bypassed through uint32_t addition overflow. The RSA request path is also affected because it lacks an equivalent length cap.