{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adpdkdpdk/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dpdk:dpdk:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-86567"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DPDK (lib/vhost)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["DPDK"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-86567 exists within the Data Plane Development Kit (DPDK) library, specifically in the lib/vhost component. The flaw originates in the VDUSE (vhost-user device in kernel) handler, which fails to properly invalidate vring pointers during IOTLB (I/O Translation Lookaside Buffer) invalidation events. This results in a use-after-unmap condition.\u003c/p\u003e\n\u003cp\u003eIn high-performance networking environments using VDUSE for offloading or virtio device emulation, this memory management error can lead to system crashes or potentially arbitrary code execution by an attacker capable of manipulating the virtio/vhost-user communication channel. Defenders should prioritize auditing the usage of DPDK in virtualized infrastructure where external device interaction is permitted. Given the low-level nature of this library, impact is primarily restricted to the host or containerized environments running vulnerable DPDK-based applications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this flaw can lead to severe system instability (denial of service) or potential code execution in the context of the DPDK application. This affects virtualized environments or cloud infrastructure providers leveraging DPDK for accelerated networking, where compromised device emulation could provide an escape vector from a virtual machine to the host or privileged management space.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of DPDK deployed within your infrastructure by auditing installed libraries and software dependencies, specifically those utilizing the lib/vhost component.\u003c/li\u003e\n\u003cli\u003eMonitor vendor security advisories from the DPDK project for patch availability and version updates addressing CVE-2026-86567.\u003c/li\u003e\n\u003cli\u003eRestrict access to VDUSE device configuration interfaces to trusted service principals to limit the attack surface for trigger-based exploitation.\u003c/li\u003e\n\u003cli\u003eDeploy kernel-level memory protections (such as hardened allocators) on hosts where DPDK applications process untrusted network traffic to mitigate the impact of memory corruption vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T18:45:38Z","date_published":"2026-10-14T18:45:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dpdk-use-after-unmap/","summary":"A use-after-unmap vulnerability in the DPDK VDUSE handler allows for potential memory corruption and system instability due to improper vring pointer invalidation.","title":"Use-After-Unmap Vulnerability in DPDK VDUSE Handler","url":"https://feed.craftedsignal.io/briefs/2026-10-dpdk-use-after-unmap/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dpdk:dpdk:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-86562"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DPDK"],"_cs_severities":["high"],"_cs_tags":["vulnerability","cve","dpdk","memory-corruption"],"_cs_type":"advisory","_cs_vendors":["DPDK"],"content_html":"\u003cp\u003eA high-severity vulnerability, CVE-2026-86562, has been identified in the DPDK (Data Plane Development Kit) lib/vhost component. The vulnerability is caused by a time-of-check time-of-use (TOCTOU) double-fetch of control-queue descriptors within the VDUSE (vDPA Device in User Space) control-queue handler. By manipulating these descriptors, an attacker can trigger a heap buffer overflow, resulting in memory corruption with attacker-controlled content. This flaw poses a significant risk to virtualized networking environments that rely on DPDK for high-performance packet processing, as successful exploitation could lead to arbitrary code execution or a denial of service. Defenders should prioritize patching or updating affected DPDK implementations to address this memory management flaw.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects the DPDK software suite used in high-performance network function virtualization (NFV) and virtual switching infrastructures. If successfully exploited, an attacker could gain elevated privileges or disrupt critical network services, potentially impacting performance across large-scale data center environments and cloud provider virtual switches.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate DPDK installations to the latest version as provided by the vendor, which includes the fix for CVE-2026-86562.\u003c/li\u003e\n\u003cli\u003eAudit network infrastructure utilizing DPDK, specifically checking for components implementing VDUSE functionality.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual service crashes or segmentation faults in processes responsible for DPDK vhost management.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T18:43:26Z","date_published":"2026-10-14T18:43:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dpdk-vhost-vulnerability/","summary":"A time-of-check time-of-use vulnerability in the DPDK lib/vhost component enables a heap buffer overflow via the VDUSE control-queue handler, potentially allowing arbitrary code execution.","title":"CVE-2026-86562: TOCTOU Vulnerability in DPDK lib/vhost","url":"https://feed.craftedsignal.io/briefs/2026-10-dpdk-vhost-vulnerability/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dpdk:dpdk:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-100236"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DPDK GSO library"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["DPDK"],"content_html":"\u003cp\u003eA memory safety vulnerability (CVE-2026-100236) has been identified in the Data Plane Development Kit (DPDK) Generic Segmentation Offload (GSO) library. The flaw exists in the mechanism that copies packet headers into a new mbuf during the GSO process. Specifically, the library fails to perform bounds checking to ensure that the packet header fits within the source first segment or the destination buffer. If a supplied packet header exceeds the configured GSO segment size, it triggers an underflow in the payload-size calculation. This vulnerability can be leveraged by a remote attacker or a malicious guest to perform out-of-bounds memory reads or writes, potentially leading to arbitrary code execution or system instability within the networking stack. This is critical for environments utilizing high-performance packet processing, such as virtual switches or NFV infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability impacts systems utilizing the DPDK framework for packet processing, particularly those exposed to untrusted network traffic or multi-tenant guest workloads. Successful exploitation can result in unauthorized memory access, causing memory corruption, system crashes, or potential elevation of privilege within the networking context. Given the core role of DPDK in virtualized environments, this flaw poses a significant risk to the integrity and availability of network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of the DPDK framework to the latest stable release that addresses CVE-2026-100236.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for malformed packets or anomalous header structures that may indicate exploitation attempts against the GSO implementation.\u003c/li\u003e\n\u003cli\u003eIsolate workloads utilizing DPDK to minimize the exposure of the networking stack to untrusted guest-originated traffic where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T18:33:58Z","date_published":"2026-10-14T18:33:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dpdk-gso-oob-access/","summary":"A vulnerability in the DPDK Generic Segmentation Offload (GSO) library allows remote or guest-supplied packets to trigger out-of-bounds memory read or write operations due to insufficient header size validation.","title":"DPDK GSO Library Out-of-Bounds Memory Access","url":"https://feed.craftedsignal.io/briefs/2026-10-dpdk-gso-oob-access/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:dpdk:dpdk:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}