DPDK vhost EUVD-2026-101423

Exploitation requires that the host run a DPDK vhost-user backend (e.g., OVS-DPDK or a DPDK-based virtual switch/NFV appliance) servicing at least one guest the attacker controls, and that the split-ring inflight descriptor feature be in use - this feature backs vhost-user reconnection/live-migration, so it is reachable in typical production configs. The attacker must already have code execution inside a connected guest VM (PR:L) and local access to the vhost-user channel (AV:L); there is no remote network path and no user interaction required. Risk is limited primarily to multi-tenant or untrusted-guest deployments: in single-tenant hosts where every guest is already trusted, the guest-to-host boundary this bug crosses is less security-relevant.

This is the most severe issue in the DPDK advisory bundle (CVSS 3.1 base 8.8 High). The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a low-complexity, low-privilege attack with a changed scope and full compromise of confidentiality, integrity, and availability - the classic signature of a guest-to-host escape in a vhost-user backend, where a malicious or compromised guest VM corrupts memory in the host-side DPDK process. The AV:L (local) metric is not a true mitigant here: 'local' reflects that the attacker speaks to the vhost-user socket from an adjacent guest rather than across the network, and the S:C (scope change) encodes the trust boundary being crossed from guest into host. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the priority rests on the high intrinsic impact (descriptor-table overflow enabling host memory corruption) rather than on observed in-the-wild activity. Signals are internally consistent - there is no CVSS-versus-description conflict for this CVE - but the risk is realized only in deployments that run DPDK vhost-user with untrusted or multi-tenant guests. In single-tenant or trusted-guest environments the practical risk is materially lower despite the 8.8 score.

In a virtualization or NFV host running a DPDK vhost-user backend, an attacker who controls a guest VM negotiates the split-ring inflight feature and submits a crafted inflight descriptor table that exceeds expected bounds, overflowing the table in the host-side DPDK process. The resulting memory corruption can be driven toward arbitrary code execution or data compromise in the host data-plane process, crossing the guest/host trust boundary (S:C). No public exploit code was identified in the provided data.