CVE-2026-86562 | BDVDB-2026-388994 Detail
Red HatRed Hat Enterprise Linux 10
Description#
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.
Weaknesses#
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
References#
- https://access.redhat.com/errata/RHSA-2026:94629
- https://access.redhat.com/errata/RHSA-2026:94630
- https://access.redhat.com/errata/RHSA-2026:96083
- https://access.redhat.com/security/cve/CVE-2026-86562
- https://bugzilla.redhat.com/show_bug.cgi?id=2529667
- https://git.dpdk.org/dpdk/commit/?id=6ec17781346e0fe4b566b6bf8f79be71f87c10e4
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.