ZeroDay Findings
Sign inSign up

Findings

CVE-2026-86848

A flaw was found in DPDK lib/vhost vhost-crypto.

Published Oct 14, 2026 · updated Oct 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

  3. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

  4. Oct 14, 2026 · OSV.dev

    Updated

    A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

Affected

  • Debian:12 dpdk22.11.1-2, 22.11.11-0+deb12u1, 22.11.2-1
  • Debian:13 dpdk24.11.2-2, 24.11.3-1, 24.11.3-1~deb13u1
  • Debian:14 dpdk24.11.2-2, 24.11.3-1, 24.11.3-1~deb13u1

Sources

  • CVE.orgCVE-2026-86848

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2026-86848

    A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2026-86848
    osv.dev

References