CVE-2026-86564 PUBLISHED

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

Assigner: redhat
Reserved: 08.09.2026 Published: 08.09.2026 Updated: 08.09.2026

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 3.3

Product Status

Vendor Red Hat
Product Fast Datapath for RHEL 10
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 10
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 8
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Fast Datapath for RHEL 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected

Workarounds

No mitigation is currently available.

Credits

  • Red Hat would like to thank Stephen Haruna for reporting this issue.

References

Problem Types

  • Out-of-bounds Read CWE