DPDK vhost-crypto CVE-2026-86847

Exploitation requires that the DPDK vhost-crypto library be deployed and exposed as a virtio-crypto device backend to an untrusted or compromised guest/client; the attacker must be able to submit crypto requests (specifically a crafted writeback descriptor chain) to that backend. Limiting factors: the backend is local-only (AV:L) and not reachable over the network, some level of guest access/privilege is required (PR:L), and vhost-crypto is an optional, non-default component not present in typical DPDK packet-forwarding deployments - so single-tenant or non-crypto DPDK installations are not affected. Impact is confined to availability (host/service hang); no data exposure or code execution.

All signals point to a locally-exploitable denial-of-service of moderate priority rather than a critical emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, 6.5 Medium) shows the only impact is availability (A:H) with no confidentiality or integrity loss, and requires local access plus some privilege (PR:L) - consistent with a malicious or compromised guest driving the host-side vhost-crypto backend, where S:C (scope change) reflects the guest-to-host trust boundary being crossed. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or probable exploitation; this is a vendor-disclosed hardening fix, not a known in-the-wild threat. Note a data caveat: the input conflates a multi-CVE DPDK advisory, and the two linked articles were blocked by an anti-bot interstitial (Anubis), so vendor-level detail (affected version ranges, fix commits) could not be independently retrieved. Bottom line: a legitimate but not urgent fix - meaningful only for multi-tenant deployments that actually expose the DPDK vhost-crypto backend to untrusted guests.

A malicious or compromised guest VM attached to a DPDK vhost-crypto (virtio-crypto) backend submits a crafted writeback descriptor chain that drives the host-side cleanup routine into an infinite loop, pinning the processing thread and denying crypto service to the host and co-located guests. Exploitation is local and low-complexity (AV:L/AC:L) but needs the attacker to already have access to the crypto device as a low-privileged guest (PR:L). No public exploit code was identified at time of analysis.