https://seclists.org/oss-sec/2026/q4/158: DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries

Q: Which DPDK releases contain the fixes?

The advisory states that fixes are included in DPDK 23.11.8, 24.11.8, and 25.11.4 LTS releases, as well as the main branch.

Q: Does exploitation require remote access or user interaction?

The CVSS vectors provided for the listed CVEs specify local attack vector (AV:L), low privileges required (PR:L), and no user interaction (UI:N).

Q: What security impact is indicated for the vhost-crypto TOCTOU issue?

CVE-2026-86848 and CVE-2026-86846 are rated CVSS 8.8 High. Their supplied vector indicates high confidentiality, integrity, and availability impact, with scope changed.

Q: Are all of the listed issues equally severe?

No. CVE-2026-86561 is rated 6.5 Medium and its vector indicates availability impact only, while CVE-2026-86562, CVE-2026-86563, and CVE-2026-86567 are rated High, at 7.8 or 8.8.

Published Oct 14, 2026

Updated

Affected Software

1 affected component

DPDK DPDK<23.11.8, <24.11.8, <25.11.4

Frequently Asked Questions

Which DPDK releases contain the fixes?

The advisory states that fixes are included in DPDK 23.11.8, 24.11.8, and 25.11.4 LTS releases, as well as the main branch.

Does exploitation require remote access or user interaction?

The CVSS vectors provided for the listed CVEs specify local attack vector (AV:L), low privileges required (PR:L), and no user interaction (UI:N).

What security impact is indicated for the vhost-crypto TOCTOU issue?

CVE-2026-86848 and CVE-2026-86846 are rated CVSS 8.8 High. Their supplied vector indicates high confidentiality, integrity, and availability impact, with scope changed.

Are all of the listed issues equally severe?