REDHAT-BUG-2529858: Medium severity DPDK vhost-crypto vulnerability
Published Sep 8, 2026
·Updated
A flaw was found in DPDK lib/vhost vhost-crypto. vhostcryptocheckchainrequest() adds uint32t length fields without overflow checks, so a wrapped sum can pass the cap while preparewritebackdata() still uses the original dstdatalen. writebackdata() then memcpy/memset that length from a host mbuf. The RSA request path has no equivalent length cap.
Affected Software
1 affected component
DPDK vhost-crypto
Event History
Sep 8, 2026
Data Sourced
via Red Hat·02:59 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What conditions are needed to trigger the vulnerable request handling?
An attacker needs to supply a vhost-crypto request chain whose uint32_t length fields wrap when added, allowing the summed length to pass the cap. The subsequent write-back handling uses the original dst_data_len when copying from or clearing a host mbuf.
2
Is the RSA request path subject to the same length cap?
No. The RSA request path has no equivalent length cap.