A flaw was found in DPDK lib/vhost vhost-crypto. rtevhostcryptofetchrequests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhostcryptofinalizeonerequest() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.