Multiple vulnerabilities were fixed in DPDK.
Fixed in DPDK 23.11.8, 24.11.8, 25.11.4 LTS releases and main branch.
---
CVE-2026-86848 / CVE-2026-86846 Summary: vhost-crypto TOCTOU out-of-bounds write in finalize path Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2001 https://bugs.dpdk.org/showbug.cgi?id=2026 CVSS 3.1: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H ---
CVE-2026-86561 Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2002 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86562 Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2003 https://bugs.dpdk.org/showbug.cgi?id=2021 CVSS 3.1: 7.8 (High) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-86563 Summary: Double offset bug in vhost log mapping calculation Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2004 CVSS 3.1: 7.8 (High) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-86567 Summary: VDUSE vring stale pointer rebinding (use-after-unmap) Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2029 CVSS 3.1: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-86566 Summary: Copy length underflow in vhost enqueue (mbuftodesc) Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2020 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86849 Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2022 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86845 Summary: Use-after-free and type confusion in vhost-crypto session handling Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2028 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86847 Summary: Infinite cleanup loop in vhost-crypto writeback chain Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2023 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86856 Summary: Stack and heap buffer overflow in nfp vDPA driver Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2027 CVSS 3.1: 6.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
---
CVE-2026-86564 Summary: Out-of-bounds heap read in vhost control virtqueue handler Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2007 CVSS 3.1: 3.3 (Low) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
---
CVE-2026-86565 Summary: Split-ring inflight descriptor table overflow Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2008 CVSS 3.1: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
---
CVE-2026-93683 Summary: Indirect descriptor table double-fetch (TOCTOU) Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2046 CVSS 3.1: 6.4 (Medium) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
---
CVE-2026-100236 Summary: GSO library heap out-of-bounds read/write with small mbuf pools Bugzilla: https://bugs.dpdk.org/showbug.cgi?id=2047 CVSS 3.1: 8.6 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
---
Acknowledgments: - Adiel Sol (Dream Group) - CVE-2026-86848 - Jia Jia - CVE-2026-86565 - syber steve - CVE-2026-86564 ---
For more information on DPDK security, see: https://doc.dpdk.org/guides/contributing/vulnerability.html
A flaw was found in DPDK lib/gso. hdrsegmentinit() copies pkthdroffset bytes from the first mbuf segment into a newly allocated header mbuf using rtememcpy without checking that the source first segment is long enough or that the destination mbuf has enough tailroom. pkthdroffset is taken from mbuf l2/l3/l4 (and outer) length fields, which applications commonly populate from packet headers including IP IHL and TCP data offset. A related uint16t subtraction (gsosize - hdroffset) underflows when the header is larger than gsosize. An application that runs software GSO on packets from an untrusted source (for example a guest via vhost, or scatter RX) can therefore read or write past mbuf bounds.
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
A flaw was found in DPDK lib/vhost vhost-crypto. preparewritebackdata() can fail after allocating a write-back node and before setting next to NULL. freewbdata() then recurses on an uninitialized next pointer, which can hang or crash the host vhost-crypto process.
A flaw was found in DPDK lib/vhost. A control-queue descriptor double-fetch in virtionetctrlpop() overflows the host heap in the VDUSE path. An incomplete fix in commit 6ec1778134 (January 2026) bounded descriptor indices but did not snapshot lengths.
From DPDK v21.05, DPDK Vhost library checksum offload feature introduced a security vulnerability enabling an untrusted or compromised guest to crash hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads.
Affected versions are only vulnerable if the Vhost-based application registers devices with the RTEVHOSTUSERNETCOMPLIANTOLFLAGS flag.
On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected.