DPDK vhost CVE-2026-86563

Exploitation requires the host to run DPDK's vhost (vhost-user) backend - typically OVS-DPDK accelerated networking in virtualization/NFV deployments - with the vhost log-mapping path active, which is exercised during guest dirty-page logging (e.g., live migration). The attacker needs local, low-privilege access to the virtualization host or control of a guest whose virtio device is serviced by the vulnerable vhost backend, allowing it to influence the log/vring address parameters that drive the miscalculated mapping offset. Limiting factors: this is not remotely exploitable over the network (AV:L), it does not affect hosts that do not deploy DPDK vhost-user, and the attacker must already have guest/local foothold (PR:L); no end-user interaction is required (UI:N).

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a locally-exploitable, low-complexity flaw requiring low privileges, with high impact across confidentiality, integrity, and availability - consistent with a memory-corruption bug (CWE-131, incorrect buffer size calculation) in DPDK's vhost library. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was referenced, so this is not confirmed to be under active exploitation; it is not a 'drop everything' internet-facing emergency. There is a notable tension between signals: the Red Hat tag labels this 'Information Disclosure,' yet the CVSS vector asserts C:H/I:H/A:H, implying memory-corruption consequences (read and write / crash) well beyond pure disclosure - treat the integrity/availability impact as credible rather than relying on the narrow tag. The local attack vector and the specialized deployment context (DPDK/vhost-user used behind OVS-DPDK in NFV and virtualization hosts) sharply limit blast radius: realistic risk is elevated primarily in multi-tenant virtualization and telco/NFV environments where an untrusted or compromised guest could reach the vhost backend, and low in environments that do not run DPDK vhost-user. Net: a genuine host-side priority for virtualization/cloud operators, but not a mass-exploitation threat.

A malicious or compromised guest VM whose virtio-net device is backed by a DPDK vhost-user backend on the host supplies crafted vring/log parameters so that the double-offset error in the vhost log-mapping calculation produces an out-of-bounds memory access in the host userspace dataplane (e.g., OVS-DPDK). This corrupts or discloses host memory, potentially crashing the dataplane (denial of service) or enabling further compromise of the vswitch process. No public exploit code was identified at time of analysis, and the local, low-complexity vector means a tenant with guest-level control is the realistic actor.