CVE-2026-86562

Published: Oct 14, 2026Modified: Oct 15, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (3)

https://access.redhat.com/security/cve/CVE-2026-86562

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2529667

Source: secalert@redhat.com

https://git.dpdk.org/dpdk/commit/?id=6ec17781346e0fe4b566b6bf8f79be71f87c10e4

Source: secalert@redhat.com

Timeline

No history available yet.