REDHAT-BUG-2529844: Medium severity DPDK vhost-crypto vulnerability

Published Sep 8, 2026

Updated

A flaw was found in DPDK lib/vhost vhost-crypto. vhostcryptoclosesess() frees a cryptodev session without invalidating the per-device session cache, so a later request with the same session id uses a dangling pointer. The data path also attaches vhostsession->sym or vhostsession->asym without checking the session type, so an asymmetric session can be treated as symmetric.

Affected Software

1 affected component

DPDK vhost-crypto

Event History

Sep 8, 2026

Data Sourced

via Red Hat·02:46 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger this flaw?

An attacker or workload must be able to cause a vhost-crypto session to be closed and later submit a request using the same session ID. The issue involves reuse of the per-device cached session entry after the underlying cryptodev session has been freed.

Does the session type affect exposure?

Yes. The data path does not verify the session type before attaching symmetric or asymmetric session state. As a result, an asymmetric session can be handled as though it were a symmetric session.

How can I determine whether an instance may be affected?

Review whether the deployment uses DPDK vhost-crypto and accepts or processes requests that create, close, and reuse cryptodev session IDs. Also check whether asymmetric cryptographic sessions are used through this data path.

REDHAT-BUG-2529844: Medium severity DPDK vhost-crypto vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger this flaw?

Does the session type affect exposure?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this flaw?

Does the session type affect exposure?

How can I determine whether an instance may be affected?