Vulnerability record/PUBLISHED/Published Oct 14, 2026 16:07:58 UTC
CVE-2026-86562
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Base score7.8/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 2, 2026 06:37:13 UTC
PublishedOct 14, 2026 16:07:58 UTC
ReservedSep 8, 2026 02:56:17 UTC
Credits
- Red Hat would like to thank Ivar Al-Safawi for reporting this issue.