RHSA-2026:94629 - Security Advisory

Topic

An update for dpdk is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.

Security Fix(es):

• dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)
• dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)
• dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)
• dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)
• dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)
• dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)
• dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)
• dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)
• dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)
• dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)
• dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)
• dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)
• dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)
• dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le

Fixes

• BZ - 2529666 - CVE-2026-86561 dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup
• BZ - 2529667 - CVE-2026-86562 dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)
• BZ - 2529668 - CVE-2026-86563 dpdk: dpdk: Double offset bug in vhost log mapping calculation
• BZ - 2529683 - CVE-2026-86565 dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write
• BZ - 2529684 - CVE-2026-86566 dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings)
• BZ - 2529685 - CVE-2026-86567 dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap
• BZ - 2529844 - CVE-2026-86845 dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup
• BZ - 2529846 - CVE-2026-86846 dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto
• BZ - 2529847 - CVE-2026-86847 dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup
• BZ - 2529853 - CVE-2026-86848 dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto
• BZ - 2529858 - CVE-2026-86849 dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto
• BZ - 2529897 - CVE-2026-86856 dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver
• BZ - 2537015 - CVE-2026-93683 dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
• BZ - 2541488 - CVE-2026-100236 dpdk: dpdk: heap out-of-bounds read/write in GSO header copy

CVEs

• CVE-2026-86561
• CVE-2026-86562
• CVE-2026-86563
• CVE-2026-86565
• CVE-2026-86566
• CVE-2026-86567
• CVE-2026-86845
• CVE-2026-86846
• CVE-2026-86847
• CVE-2026-86848
• CVE-2026-86849
• CVE-2026-86856
• CVE-2026-93683
• CVE-2026-100236

References

• https://access.redhat.com/security/updates/classification/#important