Description
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Fast Datapath for RHEL 10 | — | — |
| Red Hat | Fast Datapath for RHEL 8 | — | — |
| Red Hat | Fast Datapath for RHEL 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dpdk | 25.11.4-1 | — |
| Debian 13 | dpdk | 24.11.8-0+deb13u1 | — |
| Debian 12 | dpdk | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | dpdk | No fix yet | — |
| Ubuntu 26.04 LTS | dpdk | No fix yet | — |
| Ubuntu 24.04 LTS | dpdk | No fix yet | — |
| Ubuntu 22.04 LTS | dpdk | No fix yet | — |
| Ubuntu 20.04 LTS | dpdk | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | dpdk | No fix yet | — |
| Ubuntu 16.04 LTS | dpdk | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | dpdk +3 | 2:25.11-2.el10_2 | ALSA-2026:94630 |
| AlmaLinux 9 | dpdk +3 | 2:25.11-2.el9_8 | ALSA-2026:94629 |
| AlmaLinux 8 | dpdk +3 | 23.11-3.el8_10 | ALSA-2026:96083 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dpdk | 2:25.11-2.el10_2 | RLSA-2026:94630 |
| Rocky Linux 9 | dpdk | 2:25.11-2.el9_8 | RLSA-2026:98505, RLSA-2026:94629 |
| Rocky Linux 8 | dpdk | 23.11-3.el8_10 | RLSA-2026:96083 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | dpdk +1 | 24.11.8-150700.3.20.1 | SUSE-SU-2026:5200-1 |
| SLES 15 SP6 | dpdk +1 | 22.11.11-150600.3.21.1 | SUSE-SU-2026:5184-1 |
| SLES 15 SP5 | dpdk22 +1 | 22.11.11-150500.5.16.1 | SUSE-SU-2026:5135-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | dpdk | 22.11.11-150600.3.21.1 | SUSE-SU-2026:5184-1 |
| SLES for SAP 15 SP5 | dpdk22 | 22.11.11-150500.5.16.1 | SUSE-SU-2026:5135-1 |
| SLE Micro 5.5 | dpdk22 +1 | 22.11.11-150500.5.16.1 | SUSE-SU-2026:5135-1 |
| SLE HPC 15 SP5 | dpdk22 +1 | 22.11.11-150500.5.16.1 | SUSE-SU-2026:5135-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dpdk | 25.11.4-1.1 | openSUSE-SU-2026:12151-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | dpdk +3 | 2:25.11-2.el10_2 | ELSA-2026-94630 |
| Oracle Linux 9 | dpdk +3 | 2:25.11-2.el9_8 | ELSA-2026-94629 |
| Oracle Linux 8 | dpdk +3 | 23.11-3.el8_10 | ELSA-2026-96083 |
Advisories 15
- WID-SEC-2026-4305 Red Hat Enterprise Linux (dpdk, raptor2, dnspython): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- SUSE-SU-2026:5200-1 Security update for dpdk SUSE / openSUSE Security Updates · Nov 12, 2026
- RLSA-2026:98505 Important: dpdk security update Rocky Linux Security Advisories · Nov 12, 2026
- SUSE-SU-2026:5184-1 Security update for dpdk SUSE / openSUSE Security Updates · Nov 11, 2026
- SUSE-SU-2026:5135-1 Security update for dpdk22 SUSE / openSUSE Security Updates · Nov 10, 2026
- RLSA-2026:96083 Important: dpdk security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96083 Important: dpdk security update AlmaLinux Security Advisories · Nov 9, 2026
- ELSA-2026-96083 Important: dpdk security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ALSA-2026:94629 Important: dpdk security update AlmaLinux Security Advisories · Nov 5, 2026
- ALSA-2026:94630 Important: dpdk security update AlmaLinux Security Advisories · Nov 4, 2026
- RLSA-2026:94629 Important: dpdk security update Rocky Linux Security Advisories · Nov 4, 2026
- RLSA-2026:94630 Important: dpdk security update Rocky Linux Security Advisories · Nov 4, 2026
- ELSA-2026-94630 Important: dpdk security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- ELSA-2026-94629 Important: dpdk security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- openSUSE-SU-2026:12151-1 dpdk-25.11.4-1.1 on GA media SUSE / openSUSE Security Updates · Oct 17, 2026
References
- RHSA-2026:94629 vendor-advisory
- RHSA-2026:94630 vendor-advisory
- RHSA-2026:96083 vendor-advisory
- RHSA-2026:98505 vendor-advisory
- RHSA-2026:98616 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-93683 vdb-entry
- RHBZ#2537015 issue-tracking