DPDK vhost EUVD-2026-101421

Exploitation requires that the VDUSE (vDPA Device in Userspace) control-queue path in DPDK's lib/vhost be in active use - this is the specific feature whose handler is vulnerable; deployments not using VDUSE/vhost control queues are not exposed. The attacker must be a local, low-privileged actor (PR:L) able to act as or influence the VDUSE device backend and control the control-queue descriptor memory between the two fetches. Limiting factors: it is local-only (AV:L, no network/remote reach), no privileged network path is involved, and because it is a TOCTOU race the attacker must reliably win a narrow timing window - a single attempt may fail, so practical exploitation is probabilistic and may require many iterations.

This is a genuine privilege-escalation / host-integrity concern rather than a mass-exploitation threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring low privileges, yielding full confidentiality, integrity, and availability impact - consistent with a heap buffer overflow that enables memory corruption and likely code execution in the DPDK vhost context. No EPSS score, CISA KEV entry, or public POC was supplied, so exploitation probability signals are absent: no public exploit identified at time of analysis. The key tension is complexity: the root cause is CWE-362 (TOCTOU double-fetch), and winning a race reliably typically raises real-world attack complexity above the AC:L the input asserts - in practice exploitation requires repeated attempts to win the descriptor double-fetch window, so I assess AC:H and treat the 7.8 as an upper bound. Because the attack surface is the VDUSE (vDPA Device in Userspace) control-queue handler, the realistic attacker is a malicious or compromised userspace device backend / guest with control over the control-queue descriptors, not an anonymous network actor. Net: a meaningful local escalation/host-compromise bug for environments actually running VDUSE, but not a drop-everything internet-facing emergency.

A low-privileged local process acting as the VDUSE device backend races the vhost control-queue handler: it presents valid control-queue descriptors on the first fetch, then mutates their contents before the second fetch, causing a heap buffer overflow with attacker-controlled data inside the DPDK vhost library. By winning this TOCTOU window repeatedly, the attacker corrupts heap memory to crash or potentially execute code in the privileged datapath process. No public exploit code is known at time of analysis.