DPDK CVE-2026-86856

Exploitation requires the host to be running DPDK with the nfp vDPA driver active on Netronome/Corigine NFP (Network Flow Processor) SmartNIC hardware - this is a specific, non-ubiquitous deployment mode. The attacker must have control of a guest VM (or equivalent virtio/vhost front-end) whose datapath is offloaded through this vDPA driver, consistent with PR:L and AV:L. Limiting factors: hosts without NFP SmartNICs or not using vDPA acceleration are not affected; the attack is local to the virtualization host (no network-remote path, AV:L) and requires the privilege of driving the guest-side virtqueue, so it is not remotely reachable by an unauthenticated internet attacker. No user interaction is required (UI:N).

CVE-2026-86856 is a stack and heap buffer overflow in DPDK's nfp (Netronome/Corigine NFP) vDPA driver, vendor-scored CVSS 3.1 6.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. The local attack vector with low privilege reflects a virtualization boundary: the driver runs on the host dataplane and processes virtqueue data supplied by a guest VM, so PR:L represents control of an attacking guest rather than host privilege, and S:C (scope changed) captures the guest-to-host crossing. No EPSS score, KEV listing, or POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a Medium-severity defense-in-depth fix, not an emergency. CONFLICT/CAVEAT TO VERIFY: the vendor credits only availability (A:H) with C:N/I:N, yet a stack AND heap buffer overflow is a memory-corruption class that classically permits host memory disclosure or code execution; the A:H-only scoring is conservative and should be verified against the DPDK bugzilla (bug 2027) and upstream patch, because realistic worst-case impact may exceed a host dataplane crash. Overall this ranks below the sibling CVE-2026-86565 (8.8) in the same advisory bundle and is a priority only for deployments actually running NFP SmartNICs with vDPA.

An attacker who controls a guest VM whose virtio datapath is accelerated by a Netronome/Corigine NFP SmartNIC using DPDK's nfp vDPA driver crafts malicious virtqueue descriptors or configuration data that overflow stack and heap buffers in the host-side driver. Because the vulnerable code runs on the host and processes guest-controlled input, the overflow corrupts host DPDK process memory across the VM boundary (S:C), crashing the host dataplane (A:H) and denying service to all tenants on that host. No public exploit code was identified in the provided data.