DPDK vhost-crypto CVE-2026-86849

Requires that the DPDK vhost-crypto (virtio-crypto device) backend be enabled and in use on the host - a non-default, relatively uncommon feature - and that the attacker control a guest VM able to submit crypto requests over the vhost-user channel. The specific triggers named in the description are crafted chain-length values that overflow the integer chain-length checks, and RSA-path requests that bypass missing length validation. Limiting factors: exploitation is local only (AV:L, no network reach), needs low-level guest privileges (PR:L) rather than being unauthenticated, and is constrained to availability impact (host data-plane crash); environments that do not enable vhost-crypto are not exposed.

This is a genuine but bounded risk, best characterized as a guest-to-host denial-of-service rather than a remotely-exploitable critical flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 6.5 Medium) is internally consistent with the description: a malicious or compromised guest with low privileges (PR:L, i.e. control of a VM using the virtio-crypto device) triggers an integer overflow and out-of-bounds write (CWE-787) in the DPDK vhost-crypto host backend, and the Scope:Changed metric reflects the guest breaching the VM boundary to impact the host. Impact is availability-only (C:N/I:N/A:H), so the realistic outcome is a crash of the DPDK/host data-plane process, not data theft. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no evidence of widespread or active exploitation; prioritization should rest on the CVSS signal and the local attack surface alone. Note a limiting nuance the raw CVSS does not capture: exploitation requires the vhost-crypto feature to be enabled, which is uncommon, so real-world exposure is narrower than the 6.5 score implies. Although CWE-787 (OOB write) can in principle escalate beyond DoS to integrity/code-execution, the vendor vector asserts only A:H; this impact scope should be confirmed with Red Hat rather than assumed to be worse.

An attacker who controls a guest VM configured to use a DPDK vhost-crypto (virtio-crypto) backend sends crafted crypto requests with manipulated chain-length fields or an RSA-path payload lacking proper length validation. The integer overflow in the chain-length checks causes an out-of-bounds write into a host-side buffer, crashing the host DPDK data-plane process and denying service to co-located workloads. No public exploit code is identified at time of analysis, and exploitation requires local guest-level access (AV:L, PR:L) rather than remote network reach.