CVE-2026-86856: Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

Published Sep 8, 2026

Updated

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

Other sources

A flaw was found in the DPDK nfp vDPA driver. Vring, VFIO MSI-X, and epoll buffers are sized for NFPVDPAMAXQUEUES (one queue pair), but start and interrupt paths use unbounded rtevhostgetvringnum(). A guest or vhost-user frontend that presents more than two virtqueues can overflow stack and heap in the host vDPA backend.

— Red Hat

Affected Software

1 affected component

DPDK nfp vDPA driver

Event History

Sep 8, 2026

Data Sourced

via Red Hat·03:42 PM

DescriptionSeverityAffected Software

Oct 14, 2026

CVE Published

via MITRE·05:52 PM

Data Sourced

via MITRE·05:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Hosts using the DPDK nfp vDPA driver are exposed when their vDPA backend handles a guest or vhost-user frontend that can present more than two virtqueues. The affected paths include vDPA start and interrupt handling.

What does an attacker need to trigger the issue?

An attacker needs the ability to control or influence a guest or vhost-user frontend presented to the host vDPA backend, and configure it with more than two virtqueues. Exploitation does not require user interaction, but it does require local privileges according to the supplied vector.

What is the likely impact on the host?

Overflowing the undersized vring, VFIO MSI-X, or epoll buffers can crash the host vDPA backend or corrupt host memory. The supplied severity vector indicates high availability impact and no stated confidentiality or integrity impact.

What can be done before a fix is available?

Avoid allowing guests or vhost-user frontends to present more than two virtqueues to the affected nfp vDPA backend. Restrict untrusted users from controlling guest or frontend virtqueue configuration.

CVE-2026-86856: Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

Other sources

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the issue?

What is the likely impact on the host?

What can be done before a fix is available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the issue?

What is the likely impact on the host?

What can be done before a fix is available?