CVE-2026-86856: Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
Other sources
A flaw was found in the DPDK nfp vDPA driver. Vring, VFIO MSI-X, and epoll buffers are sized for NFPVDPAMAXQUEUES (one queue pair), but start and interrupt paths use unbounded rtevhostgetvringnum(). A guest or vhost-user frontend that presents more than two virtqueues can overflow stack and heap in the host vDPA backend.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 25.11.4-1 - Upgrade
Upgrade
debian/dpdkto a version that resolves this vulnerability.Fixed in 24.11.8-0+deb13u1Fixed in 25.11.4-1
Event History
Frequently Asked Questions
Which deployments are exposed?
Hosts using the DPDK nfp vDPA driver are exposed when their vDPA backend handles a guest or vhost-user frontend that can present more than two virtqueues. The affected paths include vDPA start and interrupt handling.
What does an attacker need to trigger the issue?
An attacker needs the ability to control or influence a guest or vhost-user frontend presented to the host vDPA backend, and configure it with more than two virtqueues. Exploitation does not require user interaction, but it does require local privileges according to the supplied vector.
What is the likely impact on the host?
Overflowing the undersized vring, VFIO MSI-X, or epoll buffers can crash the host vDPA backend or corrupt host memory. The supplied severity vector indicates high availability impact and no stated confidentiality or integrity impact.
What can be done before a fix is available?
Avoid allowing guests or vhost-user frontends to present more than two virtqueues to the affected nfp vDPA backend. Restrict untrusted users from controlling guest or frontend virtqueue configuration.