CVE-2026-86564

dpdk: dpdk: Missing length validation before reading command_data in virtio-net control queue handler

Loading…

Severity

Low

Red Hat Product Security

3.3

CVSS 3.1

Review impact separately from score.

Published · September 8, 2026

Updated · September 9, 2026

Description

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Statement

A malicious guest with access to the VDUSE virtio-net control virtqueue can trigger this flaw. Red Hat has rated this as having a security impact of Low.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is currently available.

CVSS / CWE

CVSS 3.1 · 3.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-125 · Out-of-bounds Read