DPDK vhost EUVD-2026-101306

Exploitation requires the attacker to already control a guest VM attached to a DPDK vhost-user backend and to win a time-of-check/time-of-use race: the guest must mutate the virtio indirect descriptor table length in the narrow window between the host's two reads from guest memory, or supply an out-of-range next index against a small host copy specifically in the vDPA relay path. Limiting factors: local/guest-level access and low privilege are mandatory (AV:L/PR:L), the high timing-dependency makes reliable exploitation difficult (AC:H), only hosts running DPDK vhost (and the vDPA relay path for the second variant) are affected, and the impact is confined to availability - out-of-bounds data is never disclosed to the guest.

This is a moderate, defense-in-depth-class issue rather than an urgent priority. The Red Hat CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:H, base 6.4) is internally consistent with the description: a TOCTOU race (CWE-367) exploitable only by an entity that already controls a guest (AV:L/PR:L), requires winning a timing window between two reads of the descriptor-table length (AC:H), and crosses the guest/host trust boundary (S:C) to crash or disrupt the host vhost process (A:H). No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals point to a theoretical-but-credible local DoS, not a widely-weaponized flaw. One conflict worth flagging: Red Hat assigns C:L (low confidentiality impact), but the description explicitly states the out-of-bounds bytes are consumed only as descriptor fields for GPA translation and are NOT returned to the guest as payload, which argues the realistic confidentiality impact is effectively none - verify the C:L rationale with Red Hat. The practical risk is a malicious or compromised guest degrading host/hypervisor networking availability; because it is a residual of the CVE-2018-1059 fix in the non-contiguous indirect descriptor copy path, it is narrow in scope.

An attacker who controls a guest VM on a DPDK vhost-user host crafts a virtio indirect descriptor table and races to change the table length (or supplies an out-of-range next index on a small host copy in the vDPA relay path) in the window between the host's two reads of that length. The host vhost process then walks past the validated mapping or heap copy, crashing or disrupting host-side packet processing. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means the attacker must reliably win a tight timing race.