DPDK EUVD-2026-101307

Exploitation requires the host to be running the DPDK vhost (vhost-user) datapath - e.g. OVS-DPDK or a DPDK vhost-user backend serving virtio frontends - and the attacker must control a connected vhost-user frontend (typically a guest VM or a process with access to the vhost-user socket) able to issue vhost memory-region setup messages. This matches PR:L and AV:L: the attacker needs an established, low-privilege frontend connection rather than remote network access. Limiting factors: hosts not using DPDK vhost acceleration are unaffected; the attacker must already have a foothold as a frontend/guest; no user interaction is required (UI:N); primary realistic outcome is host-side denial of service (A:H) with possible memory corruption whose further impact is unconfirmed.

This is a medium-severity (CVSS 6.5) availability-focused flaw in DPDK's lib/vhost, assessed by Red Hat with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. The signals are internally consistent and point to a bounded, not widespread, risk: the local attack vector (AV:L) and low-but-nonzero privilege requirement (PR:L) mean an attacker must already be a connected vhost-user frontend - typically a co-located/guest VM or a process with access to the vhost-user socket - rather than an anonymous remote actor, which sharply limits mass exploitation. The scope change (S:C) is the notable escalation: a malicious guest/frontend can impact the host, and the C:N/I:N/A:H profile reflects a host crash or memory corruption affecting availability rather than data theft. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatability - this reads as a defense-in-depth hardening fix against a malicious or compromised guest, not an urgent internet-facing emergency. One caveat to verify with the vendor: the description mentions 'memory corruption,' which can sometimes enable integrity/code-execution impact, yet the CVSS sets C:N/I:N - if corruption proves controllable, the real impact could exceed availability-only; treat the A:H-only scoring as the current confirmed position.

In an OVS-DPDK or DPDK-accelerated virtualization host, a malicious or compromised guest VM (acting as a vhost-user frontend) sends crafted vhost memory-region setup messages whose declared memory size is not adequately validated before the host performs mmap. The oversized or malformed region causes a host-side crash or memory corruption, taking down the hypervisor datapath and affecting other tenants. No public exploit code was identified in the provided data, and the local attack vector means the attacker must already control a connected frontend.