REDHAT-BUG-2529846: Medium severity DPDK DPDK vhost-crypto vulnerability
Published Sep 8, 2026
·Updated
A flaw was found in DPDK lib/vhost vhost-crypto. rtevhostcryptofetchrequests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhostcryptofinalizeonerequest() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.
Affected Software
1 affected component
DPDK DPDK vhost-crypto
Event History
Sep 8, 2026
Data Sourced
via Red Hat·02:48 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to control to trigger this flaw?
An attacker needs to supply a guest avail-ring descriptor index that is outside the vhost queue size. The vulnerable code uses that guest-controlled index without validating it against vq->size.
2
What is the potential impact of successful exploitation?
The invalid descriptor index can cause vhost_crypto_finalize_one_request() to write outside the used ring. The provided information identifies this as an out-of-bounds write.