See how dpdk compares to other vendors in security performance
Multiple vulnerabilities were fixed in DPDK.
Fixed in DPDK 23.11.8, 24.11.8, 25.11.4 LTS releases and main branch.
---
CVE-2026-86848 / CVE-2026-86846 Summary: vhost-crypto TOCTOU out-of-bounds write in finalize path Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2001 https://bugs.dpdk.org/showbug.cgi?id=2026 CVSS 3.1: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H ---
CVE-2026-86561 Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2002 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86562 Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2003 https://bugs.dpdk.org/showbug.cgi?id=2021 CVSS 3.1: 7.8 (High) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-86563 Summary: Double offset bug in vhost log mapping calculation Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2004 CVSS 3.1: 7.8 (High) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-86567 Summary: VDUSE vring stale pointer rebinding (use-after-unmap) Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2029 CVSS 3.1: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-86566 Summary: Copy length underflow in vhost enqueue (mbuftodesc) Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2020 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86849 Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2022 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86845 Summary: Use-after-free and type confusion in vhost-crypto session handling Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2028 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86847 Summary: Infinite cleanup loop in vhost-crypto writeback chain Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2023 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86856 Summary: Stack and heap buffer overflow in nfp vDPA driver Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2027 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86564 Summary: Out-of-bounds heap read in vhost control virtqueue handler Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2007 CVSS 3.1: 3.3 (Low) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
---
CVE-2026-86565 Summary: Split-ring inflight descriptor table overflow Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2008 CVSS 3.1: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-93683 Summary: Indirect descriptor table double-fetch (TOCTOU) Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2046 CVSS 3.1: 6.4 (Medium) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
---
CVE-2026-100236 Summary: GSO library heap out-of-bounds read/write with small mbuf pools Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2047 CVSS 3.1: 8.6 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
---
Acknowledgments: - Adiel Sol (Dream Group) - CVE-2026-86848 - Jia Jia - CVE-2026-86565 - syber steve - CVE-2026-86564 ---
For more information on DPDK security, see: https://doc.dpdk.org/guides/contributing/vulnerability.html
A flaw was found in DPDK lib/gso. hdrsegmentinit() copies pkthdroffset bytes from the first mbuf segment into a newly allocated header mbuf using rtememcpy without checking that the source first segment is long enough or that the destination mbuf has enough tailroom. pkthdroffset is taken from mbuf l2/l3/l4 (and outer) length fields, which applications commonly populate from packet headers including IP IHL and TCP data offset. A related uint16t subtraction (gsosize - hdroffset) underflows when the header is larger than gsosize. An application that runs software GSO on packets from an untrusted source (for example a guest via vhost, or scatter RX) can therefore read or write past mbuf bounds.
A flaw was found in DPDK lib/gso. hdrsegmentinit() copies pkthdroffset bytes from the first mbuf segment into a newly allocated header mbuf using rtememcpy without checking that the source first segment is long enough or that the destination mbuf has enough tailroom. pkthdroffset is taken from mbuf l2/l3/l4 (and outer) length fields, which applications commonly populate from packet headers including IP IHL and TCP data offset. A related uint16t subtraction (gsosize - hdroffset) underflows when the header is larger than gsosize. An application that runs software GSO on packets from an untrusted source (for example a guest via vhost, or scatter RX) can therefore read or write past mbuf bounds.
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
A flaw was found in the DPDK nfp vDPA driver. Vring, VFIO MSI-X, and epoll buffers are sized for NFPVDPAMAXQUEUES (one queue pair), but start and interrupt paths use unbounded rtevhostgetvringnum(). A guest or vhost-user frontend that presents more than two virtqueues can overflow stack and heap in the host vDPA backend.
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
A flaw was found in DPDK lib/vhost vhost-crypto. vhostcryptocheckchainrequest() adds uint32t length fields without overflow checks, so a wrapped sum can pass the cap while preparewritebackdata() still uses the original dstdatalen. writebackdata() then memcpy/memset that length from a host mbuf. The RSA request path has no equivalent length cap.
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot still double-fetches srcdesc->next: it checks the index, then indexes the live guest table with a second read. A guest can change next after the check and force an out-of-bounds access. This is a remaining TOCTOU after CVE-2020-14375, not that ID.
A flaw was found in DPDK lib/vhost vhost-crypto. preparewritebackdata() can fail after allocating a write-back node and before setting next to NULL. freewbdata() then recurses on an uninitialized next pointer, which can hang or crash the host vhost-crypto process.
A flaw was found in DPDK lib/vhost vhost-crypto. preparewritebackdata() can fail after allocating a write-back node and before setting next to NULL. freewbdata() then recurses on an uninitialized next pointer, which can hang or crash the host vhost-crypto process.
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
A flaw was found in DPDK lib/vhost vhost-crypto. rtevhostcryptofetchrequests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhostcryptofinalizeonerequest() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
A flaw was found in DPDK lib/vhost vhost-crypto. vhostcryptoclosesess() frees a cryptodev session without invalidating the per-device session cache, so a later request with the same session id uses a dangling pointer. The data path also attaches vhostsession->sym or vhostsession->asym without checking the session type, so an asymmetric session can be treated as symmetric.
A flaw was found in DPDK lib/vhost. The VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated. A worker thread can continue using dangling vring pointers after munmap(), leading to a crash or use-after-rebind.
A flaw was found in DPDK lib/vhost. The VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated. A worker thread can continue using dangling vring pointers after munmap(), leading to a crash or use-after-rebind.
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
A flaw was found in DPDK lib/vhost. Runt RX descriptors underflow the copy length in vhost enqueue on both split and packed rings. Unsigned subtraction underflow allows a full packet copy past a tiny descriptor window, which can crash a host vswitch such as OVS-DPDK.
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
A flaw was found in DPDK lib/vhost. Virtqueue size can be desynchronized from the inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
A flaw was found in DPDK lib/vhost. The virtio-net control-queue handler reads commanddata without validating that the copied request is long enough. This out-of-bounds read can cause a host process crash under hardened allocators or sanitizers.
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
A flaw was found in DPDK lib/vhost. The vhost log mapping calculation applies the mmap offset twice, which can lead to incorrect memory access.
A flaw was found in DPDK lib/vhost. A control-queue descriptor double-fetch in virtionetctrlpop() overflows the host heap in the VDUSE path. An incomplete fix in commit 6ec1778134 (January 2026) bounded descriptor indices but did not snapshot lengths.
A flaw was found in DPDK lib/vhost. A control-queue descriptor double-fetch in virtionetctrlpop() overflows the host heap in the VDUSE path. An incomplete fix in commit 6ec1778134 (January 2026) bounded descriptor indices but did not snapshot lengths.
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.