CVE-2026-86565
8.2HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
A privileged attacker in a guest VM can trigger an out-of-bounds write in the host vhost process, potentially achieving host code execution or crashing the host. They need administrative access inside the guest VM to exploit it.
Root cause
The DPDK lib/vhost component allows a guest to desynchronize virtqueue size from the inflight descriptor table size, triggering an out-of-bounds write.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Apply vendor-provided DPDK security patches once released; no known configuration mitigation is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.