A flaw was found in DPDK lib/vhost. The VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated. A worker thread can continue using dangling vring pointers after munmap(), leading to a crash or use-after-rebind.
A flaw was found in DPDK lib/vhost. The VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated. A worker thread can continue using dangling vring pointers after munmap(), leading to a crash or use-after-rebind.
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
A flaw was found in DPDK lib/vhost. Runt RX descriptors underflow the copy length in vhost enqueue on both split and packed rings. Unsigned subtraction underflow allows a full packet copy past a tiny descriptor window, which can crash a host vswitch such as OVS-DPDK.
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
A flaw was found in DPDK lib/vhost. Virtqueue size can be desynchronized from the inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
A flaw was found in DPDK lib/vhost. The virtio-net control-queue handler reads commanddata without validating that the copied request is long enough. This out-of-bounds read can cause a host process crash under hardened allocators or sanitizers.
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
A flaw was found in DPDK lib/vhost. The vhost log mapping calculation applies the mmap offset twice, which can lead to incorrect memory access.
A flaw was found in DPDK lib/vhost. A control-queue descriptor double-fetch in virtionetctrlpop() overflows the host heap in the VDUSE path. An incomplete fix in commit 6ec1778134 (January 2026) bounded descriptor indices but did not snapshot lengths.
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
A flaw was found in DPDK lib/vhost. The vhost-user SETMEMTABLE mmap path does not adequately validate frontend-supplied region size before mapping, which may lead to denial of service in the host vhost backend. Integer-overflow and zero-size-after-align checks are already present; the remaining size check is as reported by the DPDK vhost maintainer.