EUVD-2026-101484
GHSA-62fj-4whq-8247
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted traffic to GSO path
-
DeliveryTrigger segmentation with small mbuf pool
-
ExploitHeap out-of-bounds read/write
-
ExecutionCorrupt adjacent heap memory
-
ImpactCrash data-plane process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a deployment that uses the DPDK GSO library (rte_gso) on its packet path AND is configured with small/undersized mbuf pools relative to the segmentation workload - the summary explicitly scopes the heap out-of-bounds read/write to this small-mbuf-pool condition. The attacker must be able to deliver traffic that is processed through the GSO segmentation path. Limiting factors: the bug is gated on the specific (non-default-looking) small mbuf pool configuration and on the application actually enabling GSO, so default or generously-sized pool deployments may not be affected; impact is primarily availability (A:H) with only partial confidentiality/integrity effect, so the realistic outcome is a data-plane crash rather than full compromise. |
| Impact | CVE-2026-100236 carries a vendor CVSS 3.1 base score of 8.6 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write in the DPDK Generic Segmentation Offload (GSO) library. The high score is driven by the network attack vector with no privileges or user interaction and a high availability impact (A:H), with only limited confidentiality and integrity impact (C:L/I:L). No EPSS score, CISA KEV listing, SSVC decision, or proof-of-concept is present in the supplied data, so exploitation status is: no public exploit identified at time of analysis. The signals are therefore in tension: the CVSS vector argues for a genuine remotely-triggerable priority, but the description explicitly scopes the flaw to deployments 'with small mbuf pools,' which is a non-default/tuning-dependent precondition that the AC:L rating does not reflect - this suggests real-world exploitability is narrower than 8.6 implies. The primary realistic outcome is denial of service (data-plane crash) rather than code execution, since C:L/I:L indicate only partial info/integrity effect. Net: treat as a patch-soon infrastructure bug for DPDK-based data planes, but note the gap between the headline score and the configuration-gated trigger condition - verify mbuf pool sizing against the advisory before treating as broadly weaponizable. |
| Exploit ScenarioDerived | An attacker sends crafted network traffic to a DPDK-based appliance or virtual switch that routes packets through the GSO library while configured with undersized mbuf pools. The malformed/oversized segmentation workload drives a heap out-of-bounds read/write, corrupting adjacent memory and crashing the data-plane process, causing denial of service. No authentication or user interaction is required per the CVSS vector, but no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap out-of-bounds read and write in the DPDK Generic Segmentation Offload (rte_gso) library can be triggered when an application enables GSO on its packet path and is configured with small or undersized mbuf pools relative to the segmentation workload, letting network-delivered traffic corrupt memory in the data plane. The vendor-published CVSS 3.1 base score is 8.6 (High) on a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write; our independent assessment keeps the network-reachable, unauthenticated profile but assesses higher attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) because exploitation is gated on the non-default-looking small-mbuf-pool configuration together with GSO actually being enabled. Impact is dominated by availability (A:H), so the realistic outcome is a data-plane crash rather than full host compromise, with only partial confidentiality and integrity effects; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
RemediationAI
No vendor-released patch has been identified at time of analysis for the GSO heap out-of-bounds read/write, so remediation is currently configuration-based: verify against the DPDK advisory at https://seclists.org/oss-sec/2026/q4/158 and the Bugzilla entry at https://bugs.dpdk.org/show_bug.cgi?id=2047 whether an updated DPDK release or upstream commit has since been published, and if so upgrade to that exact version. In the interim, the single most effective control is to stop exercising the vulnerable code path - disable GSO (do not call rte_gso_segment) in affected applications, or keep GSO enabled only for trusted, internal traffic and terminate untrusted flows before the segmentation stage; the trade-off is that software segmentation and per-packet header rewriting move back into the application, increasing CPU cost and reducing throughput on high-packet-rate paths. If GSO must remain enabled, re-size mempools so that mbuf data-room and pool capacity are generously provisioned for the largest segmentation workload (avoiding the small-mbuf-pool precondition), accepting a higher memory footprint per port and the need to re-tune cache sizes to avoid pool exhaustion under burst. Where supported, push segmentation offload to NIC hardware (TSO/checksum offload) instead of rte_gso, noting this depends on NIC offload capability and may not be available for virtual or software-backed ports; also run the data plane under a restricted/sandboxed service account and apply IOMMU/VFIO isolation so that a heap-corruption crash in the process is contained rather than escalated. Because impact here is primarily availability, monitoring and auto-restart of the data-plane process will reduce outage duration but will not prevent the underlying memory error.
Affected ProductsAI
The affected product is the DPDK Generic Segmentation Offload library (rte_gso) as shipped in DPDK releases, affecting any deployment that calls the GSO API on its packet path with small or undersized mbuf pools; the supplied data does not state an exact version range or CPE string, so the precise affected releases must be confirmed against the DPDK advisory and the bug tracker rather than assumed. The same oss-security advisory (https://seclists.org/oss-sec/2026/q4/158) covers sibling defects in the vhost, vhost-crypto, vDPA and nfp driver code, tracked in the DPDK Bugzilla at https://bugs.dpdk.org/show_bug.cgi?id=2047 for this CVE and at https://bugs.dpdk.org/show_bug.cgi?id=2007, https://bugs.dpdk.org/show_bug.cgi?id=2027 and https://bugs.dpdk.org/show_bug.cgi?id=2008 for related issues, so operators should treat vhost/vDPA-based virtual switching, vhost-crypto offload and nfp vDPA deployments as in scope for the wider advisory.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DPDK (Data Plane Development Kit) is a user-space packet-processing framework in which poll-mode drivers bypass the kernel and operate directly on mbufs allocated from mempools. The Generic Segmentation Offload (GSO) library, rte_gso, re-segments large 'super-packets' received from the application into MTU-sized segments, copying header data and chaining mbufs from the configured pool. When the mbuf pool is too small for the segmentation workload - for example segments of a size that exceeds the available data-room or chain capacity of the supplied mbufs - the segmentation routine's buffer-size arithmetic can index outside the intended buffer, producing an out-of-bounds heap read and, in the write path, heap corruption. The root-cause class is an out-of-bounds memory access (the CWE-125 read / CWE-787 write family), although no CWE is formally assigned in the supplied data. This CVE is one item in a broader oss-security advisory covering multiple defects across the vhost, vhost-crypto, vDPA and GSO libraries, all of which follow the same threat model: a local or network-adjacent virtualisation/data-plane component mishandling descriptors, sessions or buffers, with local-vector peers such as CVE-2026-86565 (split-ring inflight descriptor table overflow, 8.8 High, C:H/I:H/A:H), CVE-2026-93683 (indirect descriptor table double-fetch TOCTOU, 6.4 Medium), CVE-2026-86845 and CVE-2026-86847 (vhost-crypto use-after-free/type confusion and infinite cleanup loop, both 6.5 Medium), CVE-2026-86856 (nfp vDPA stack/heap overflow, 6.5 Medium) and CVE-2026-86564 (vhost control virtqueue out-of-bounds heap read, 3.3 Low). Unlike those local, PR:L peers, this GSO issue is uniquely reachable over the network (AV:N) and unauthenticated (PR:N), which is why it carries the highest score of the GSO-specific items.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Network-triggerable via segmented traffic (AV:N, PR:N), but gated on a specific small-mbuf-pool configuration, so AC:H; primarily a heap-corruption DoS with limited C/I impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
CVE-2026-100236 is a high-severity heap out-of-bounds read/write in the DPDK rte_gso library that can crash or corrupt data-plane memory when GSO is enabled with undersized mbuf pools. Organizations running DPDK-based network functions, gateways, or NFV workloads are most exposed, especially where untrusted network traffic reaches the packet path, and the issue is network-reachable and unauthenticated though exploitation depends on a non-default small-mbuf-pool configuration. Impact is primarily availability with only limited confidentiality and integrity effects, and No vendor-released patch identified at time of analysis, making interim configuration controls critical.
Disable GSO on affected packet paths; right-size or over-provision mbuf pools; isolate or segment untrusted network traffic; monitor for data-plane crashes; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB