DPDK

CVE-2026-86848 is a critical out-of-bounds access vulnerability in DPDK lib/vhost vhost-crypto caused by a double-fetch of a guest descriptor index, enabling a malicious guest to compromise the host backend.

A use-after-unmap vulnerability in the DPDK VDUSE handler allows for potential memory corruption and system instability due to improper vring pointer invalidation.

A time-of-check time-of-use vulnerability in the DPDK lib/vhost component enables a heap buffer overflow via the VDUSE control-queue handler, potentially allowing arbitrary code execution.

A vulnerability in the DPDK Generic Segmentation Offload (GSO) library allows remote or guest-supplied packets to trigger out-of-bounds memory read or write operations due to insufficient header size validation.