DPDK vhost CVE-2026-86566

Requires the attacker to control a guest VM whose virtio/vhost RX descriptor ring is served by a shared host-side vhost-user backend such as OVS-DPDK; the guest must present undersized ('runt') RX descriptors that drive the copy-length underflow in the host vhost enqueue path. Limiting factors: exploitation is local to the virtualization host (AV:L) and needs guest-level control (PR:L) - it is not reachable by a remote unauthenticated network attacker; it is only relevant where a vhost/OVS-DPDK shared backend is actually deployed, and impact is confined to denial of service of that shared datapath (no confidentiality or integrity effect).

This is a moderate-severity availability issue (CVSS 6.5) best understood as a guest-to-host denial-of-service in multi-tenant virtualization. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) tells a consistent story: a local vector (the attacker is a malicious or compromised guest, not a remote network client), low attack complexity, low privilege (guest-level control is enough), no user interaction, and a changed scope because a guest crosses the trust boundary to disrupt the shared host-side vhost backend (e.g. OVS-DPDK). Impact is purely availability (C:N/I:N/A:H) - consistent with an integer underflow (CWE-191) that corrupts a copy length and crashes the shared datapath, with no code-execution or data-disclosure claim in the source data. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the input, so by the precision rules this is 'no public exploit identified at time of analysis.' The real-world priority is context-dependent: in single-tenant or trusted-guest deployments the risk is low, but in multi-tenant NFV/cloud environments where one guest can take down a shared vswitch serving other tenants, the scope change (S:C) makes this meaningfully more serious than the base 6.5 suggests. Note the vector is AV:L, so despite 'network data plane' framing this is NOT remotely exploitable by an unauthenticated internet attacker - it requires control of a co-located guest.

An attacker who controls a guest VM (through legitimate tenancy or prior compromise) attached to a shared OVS-DPDK vhost-user backend programs its RX descriptor ring with undersized ('runt') descriptors. When the host-side vhost enqueue path computes a copy length against these descriptors, an integer underflow produces an enormous length value, crashing or wedging the shared vhost backend and denying network service to all guests on that host. No public exploit code is identified in the available data.