CVE-2026-86567

8.8High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-416

Impact

A local attacker with access to DPDK can escape virtualization boundaries and achieve full host compromise or crash the system. Exploitation requires local authenticated access capable of triggering vring operations against DPDK's lib/vhost.

Root cause

The VDUSE handler in lib/vhost fails to invalidate vring pointers during IOTLB invalidation, causing a use-after-unmap condition.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade DPDK packages once vendor security errata are available; in the meantime, disable VDUSE features or restrict untrusted local users from accessing DPDK vhost interfaces.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-86567