EUVD-2026-101509
GHSA-7ww6-vqp6-25qm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv access inside guest VM
-
DeliverySend crafted vhost-crypto session requests
-
ExploitTrigger use-after-free/type confusion in session handling
-
ExecutionCorrupt host DPDK process state
-
ImpactCrash host vhost process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Expired pointer prevention
|
| Exploitation Conditions | Requires the host to be running DPDK with the vhost-crypto library enabled (virtio-crypto device backend exposed to guests), and the attacker must have local access to drive that device - typically control of a guest VM or a local process with access to the vhost-crypto virtqueues. Exploitation is limited by the local attack vector (no network reachability per AV:L) and the need for an active vhost-crypto session path; deployments that do not use DPDK crypto offload / vhost-crypto are not affected. No user interaction is needed (UI:N) and only low privilege is required (PR:L). Realistic impact is confined to denial of service of the host DPDK process (A:H; C:N/I:N). |
| Impact | CVE-2026-86845 is a use-after-free and type confusion in DPDK's vhost-crypto session handling, scored CVSS 3.1 6.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. The signals are internally consistent and point to a bounded, availability-only threat rather than a critical priority: the local attack vector (AV:L) means the attacker must already be positioned inside a guest VM or local context that drives the vhost-crypto virtio device, low complexity (AC:L) and low privilege (PR:L) make triggering easy once that position is held, and the scope change (S:C) is the meaningful aggravator - a malicious guest can impact the host-side DPDK process, i.e. a guest-to-host containment break. However, impact is confined to availability (A:H; C:N/I:N), so the realistic outcome is a host-process crash / denial of service, not data theft or code execution as rated. No EPSS score, KEV listing, or POC was provided in the input, so there is no public evidence of exploitation. Caveat worth verifying: use-after-free and type-confusion bugs can in principle be escalated beyond a crash to memory corruption or code execution, yet the vendor (DPDK) scored C:N/I:N - teams concerned about a weaponized exploit should confirm with DPDK whether controlled corruption is achievable. Within the bundled advisory this is a mid-tier item; CVE-2026-86565 (8.8, full CIA) and CVE-2026-100236 (8.6, network-reachable) are the higher-priority siblings. |
| Exploit ScenarioDerived | A tenant with control of a guest VM (or a local process with access to the virtio-crypto device) issues crafted vhost-crypto session-management operations against the host's DPDK vhost-crypto backend. Malformed or racing session create/destroy requests drive a use-after-free / type confusion in session handling, corrupting host-side state and crashing the DPDK process, which disrupts networking/crypto offload for co-located workloads. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free and type confusion in DPDK's vhost-crypto session handling allow a local attacker, such as a malicious guest VM or a low-privileged local process, to cause a denial of service on the host DPDK process. The vulnerability requires the host to run DPDK with the vhost-crypto library enabled and exposed to guests; it is scored CVSS 3.1 6.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. No public exploit identified at time of analysis.
RemediationAI
Apply the patch provided by the DPDK project as referenced in the security advisory (Bugzilla 2028) and the oss-security post. Because no exact fixed version is listed in the available data, check the advisory for the release that contains the fix. Until patching is possible, mitigate by disabling the vhost-crypto library or preventing untrusted guests and local processes from accessing virtio-crypto devices-for example, remove the vhost-crypto backend from DPDK applications or restrict guest access to the crypto virtqueues. This will disable hardware crypto offload for guests but eliminates the attack surface. Additionally, ensure that only trusted VMs and processes can interact with the DPDK vhost-crypto interfaces, and monitor for unexpected host DPDK process crashes. No public exploit code exists at time of analysis, but local attackers with access to the crypto virtqueues could trigger the denial of service.
Affected ProductsAI
Affected product is DPDK (Data Plane Development Kit) when built with the vhost-crypto library and configured to expose virtio-crypto devices to guests. No specific version range or CPE string was provided in the available data; the advisory at https://bugs.dpdk.org/show_bug.cgi?id=2028 and the oss-security post (https://seclists.org/oss-sec/2026/q4/158) should be consulted for exact affected releases. Other CVEs in the same advisory affect different DPDK components (e.g., vhost control virtqueue, nfp vDPA driver, GSO library), but this CVE is scoped to vhost-crypto session handling. Deployments that do not use DPDK vhost-crypto or do not expose it to untrusted guests are not affected.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the vhost-crypto library of the Data Plane Development Kit (DPDK), which provides a virtio-crypto device backend for guest VMs to offload cryptographic operations to the host. The root cause is a combination of use-after-free (CWE-416) and type confusion (CWE-843) in the session handling logic, where a session object is freed but later accessed, or an object of one type is treated as another. The CVSS vector indicates scope change (S:C), meaning the vulnerable component can impact resources beyond its security scope, specifically the host DPDK process. Exploitation requires local access (AV:L) and low privileges (PR:L), with no user interaction (UI:N). The impact is limited to availability (A:H), with no confidentiality or integrity impact (C:N/I:N). This CVE is part of a larger DPDK security advisory covering multiple components (vhost, vDPA, GSO), but this entry specifically concerns vhost-crypto session handling (Bugzilla 2028).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Attacker must be local within a guest (AV:L) with low privilege to reach the vhost-crypto device (PR:L); guest-to-host process crash gives S:C and A:H, with no confirmed confidentiality/integrity impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
DPDK's vhost-crypto session handling contains a use-after-free and type confusion flaw that can let an authenticated low-privileged local attacker, including a malicious guest VM, crash or deny service to the host DPDK process. Organizations running DPDK with vhost-crypto exposed to guests face availability risk for hosts supporting virtualized networking or multi-tenant workloads, although no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis. Leadership should prioritize identifying exposed deployments and limiting guest and local access until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the vhost-crypto library if it is not required, preventing exposure of vhost-crypto to untrusted guest VMs, restricting low-privileged local access to DPDK processes, isolating or monitoring affected DPDK hosts for crashes or restarts, and applying vendor guidance as it becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB