High priorityDisclosed

Advisory · CVE-2026-86567

DPDK vhost VDUSE handler can use memory after it is unmapped

A flaw in DPDK lib/vhost: the VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap that a local low-privilege attacker can turn into code execution with changed scope. Red Hat rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
DPDK
Product
DPDK
Identifier / CWE
CVE-2026-86567
CWE-416
Action timing
Immediate
ELI5

Explain it like I’m five

The virtual switch keeps pointers to memory that has been unmapped, and later trusts them anyway.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01IOTLB invalidated

    The VDUSE handler invalidates the IOTLB but fails to invalidate the vring pointers that referenced the mapping.

  2. 02Stale pointers used

    Later vhost processing follows pointers into memory that is no longer mapped as expected.

  3. 03Use-after-unmap lands

    The stale access can corrupt the host-side vhost process and change scope.

What happened

Red Hat disclosed CVE-2026-86567 in DPDK lib/vhost, shipped in its Fast Datapath, Enterprise Linux dpdk packages, OpenShift openvswitch packages, and OpenStack. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

Red Hat’s bulletin lists the affected product packages. Apply the updated DPDK and Open vSwitch packages for your platform rather than relying on a version guess here.

What to do

  1. Inventory every DPDK deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to DPDK while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for vhost or vswitch process crashes tied to VDUSE devices and guest IOTLB activity.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

A use-after-unmap in the host’s vhost path is a guest-to-host concern. Patch virtualization hosts before tenant workloads get creative.