RHSA-2026:94630HighCVSS 8.8

Red Hat Security Advisory: dpdk security update

Published
November 3, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (14)

CVE-2026-86565 →CVE-2026-86847 →CVE-2026-86849 →CVE-2026-86856 →CVE-2026-100236 →CVE-2026-86562 →CVE-2026-86563 →CVE-2026-86566 →CVE-2026-86567 →CVE-2026-86845 →CVE-2026-86846 →CVE-2026-86848 →CVE-2026-93683 →CVE-2026-86561 →

📋 Description

CVE-2026-86561 — dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86562 — dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) CVE-2026-86563 — dpdk: dpdk: Double offset bug in vhost log mapping calculation CVE-2026-86565 — dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write CVE-2026-86566 — dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) CVE-2026-86567 — dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap CVE-2026-86845 — dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup CVE-2026-86846 — dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto CVE-2026-86847 — dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup CVE-2026-86848 — dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto CVE-2026-86849 — dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto CVE-2026-86856 — dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver CVE-2026-93683 — dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU CVE-2026-100236 — dpdk: dpdk: heap out-of-bounds read/write in GSO header copy

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-2:25.11-2.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-debuginfo-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-debuginfo-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-debuginfo-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-debugsource-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-debugsource-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-debugsource-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-devel-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-devel-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-devel-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-doc-2:25.11-2.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-tools-2:25.11-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-tools-2:25.11-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • dpdk-tools-2:25.11-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not attach a virtio-crypto vhost-user backend to untrusted guests. Workaround: Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted guests to an NFP VF running with class=vdpa. Workaround: No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests. Workaround: Do not run software GSO (rte_gso_segment / testpmd --enable-gso) on untrusted packets. Size direct_pool larger than the max header (~208 B tunneled). That does not fully cover the short-first-segment over-read.

🔗 References (17)