Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

Summary

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

Timeline

1. Oct 14, 2026, 4:07 PM UTCCVE published
2. Oct 15, 2026, 6:57 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 20, 2026, 2:39 AM UTCRecord last updated

Affected versions

• grout

  Version range not reported

• openvswitch3.5

  Version range not reported

• openvswitch3.6

  Version range not reported

• openvswitch2.11

  Version range not reported

• openvswitch2.12

  Version range not reported

• openvswitch2.13

  Version range not reported

• openvswitch2.15

  Version range not reported

• openvswitch2.16

  Version range not reported

• openvswitch2.17

  Version range not reported

• openvswitch3.1

  Version range not reported

• grout

  Version range not reported

• openvswitch2.17

  Version range not reported

• openvswitch3.0

  Version range not reported

• openvswitch3.1

  Version range not reported

• openvswitch3.2

  Version range not reported

• openvswitch3.3

  Version range not reported

• openvswitch3.4

  Version range not reported

• openvswitch3.5

  Version range not reported

• openvswitch3.6

  Version range not reported

• dpdk

  Version range not reported

• dpdk

  Version range not reported

• dpdk

  Version range not reported

• openvswitch2.17

  Version range not reported

• openvswitch3.0

  Version range not reported

• openvswitch3.1

  Version range not reported

• openvswitch

  Version range not reported

References 3