CVE-2026-86847

dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup

Loading…

Severity

Moderate

Red Hat Product Security

6.5

CVSS 3.1

Review impact separately from score.

Published · October 15, 2026

Updated · November 4, 2026

Description

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

Statement

A guest with a virtio-crypto vhost-user device can trigger this flaw. Red Hat has rated this as having a security impact of Moderate. Product impact depends on whether vhost-crypto is built and enabled.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Do not attach a virtio-crypto vhost-user backend to untrusted guests.

CVSS / CWE

CVSS 3.1 · 6.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CWE-824 · Access of Uninitialized Pointer