A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot still double-fetches srcdesc->next: it checks the index, then indexes the live guest table with a second read. A guest can change next after the check and force an out-of-bounds access. This is a remaining TOCTOU after CVE-2020-14375, not that ID.