CVE-2026-86562
7.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-362
Impact
A local attacker with low privileges can trigger a heap buffer overflow to compromise integrity, crash the process, or potentially execute code. They need local access to communicate with the DPDK VDUSE control-queue handler.
Root cause
A TOCTOU double-fetch flaw in lib/vhost allows descriptors in the VDUSE control queue to be modified between check and use.
Affected systems
DPDK with lib/vhost VDUSE support enabled; exact versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the upstream patch from commit 6ec17781346e0fe4b566b6bf8f79be71f87c10e4 or update your vendor-provided DPDK package once available. As an interim workaround, disable or restrict access to VDUSE devices if not strictly required.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.