Vulnerability record/PUBLISHED/Published Oct 14, 2026 16:08:22 UTC

CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

Base score8.2/ 10

SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorLocalAV

Attack complexityLowAC

Privileges requiredHighPR

User interactionNoneUI

ScopeChangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactHighA

CVSS vector stringCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityredhat

Last updatedNov 2, 2026 06:37:23 UTC

PublishedOct 14, 2026 16:08:22 UTC

ReservedSep 8, 2026 02:56:38 UTC