CVE-2026-86562
A flaw was found in DPDK lib/vhost.
Published Oct 14, 2026 · updated Oct 14, 2026
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Oct 14, 2026 · OSV.dev
Updated
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
Affected
- Debian:12 dpdk22.11.1-2, 22.11.11-0+deb12u1, 22.11.2-1
- Debian:13 dpdk24.11.2-2, 24.11.3-1, 24.11.3-1~deb13u1
- Debian:14 dpdk24.11.2-2, 24.11.3-1, 24.11.3-1~deb13u1
Sources
- CVE.orgCVE-2026-86562
Official CVE identifier
cve.org - NIST NVDCVE-2026-86562
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-86562osv.dev