CVE-2026-86566 in DPDK
Summary
by MITRE • 10/14/2026
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within the Data Plane Development Kit (DPDK) specifically affects the lib/vhost component, which serves as the interface between virtual machines and high-performance network data paths. This flaw manifests when a guest operating system or virtual machine sends runt receive descriptors to the vhost backend. In this context, a runt descriptor refers to an Ethernet frame that is smaller than the minimum allowed size for standard Ethernet traffic. The core technical issue lies in how the vhost enqueue function processes these malformed inputs. Specifically, the logic fails to adequately validate the length of the data being copied from the guest's memory into the backend buffer. When a runt RX descriptor is processed, the calculated copy length can become negative or erroneously small due to integer underflow conditions inherent in the arithmetic operations used for size calculation. This mathematical error results in an incorrect pointer offset or buffer boundary check failure during the enqueue operation.
The operational impact of this vulnerability is primarily centered on system stability and availability rather than data confidentiality or integrity. Because the copy length underflows, the vhost backend may attempt to access memory regions outside its intended bounds or fail to properly initialize packet structures. In shared vhost environments such as Open vSwitch with DPDK integration (OVS-DPDK), this instability can lead to a crash of the virtual switch process. Since OVS-DPDK often handles traffic for multiple virtual machines, a single malicious or misconfigured guest triggering this flaw can cause a denial of service that affects all other workloads relying on that shared backend instance. This represents a significant risk in multi-tenant cloud environments where isolation between tenants is critical and the failure of the networking infrastructure disrupts broader connectivity.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, as the root cause is an arithmetic operation producing an unexpected result due to exceeding the limits of the data type used for length calculation. Furthermore, it relates to CWE-20 Improper Input Validation because the system fails to properly sanitize or verify the size attributes provided by the guest before processing them in critical memory operations. In terms of adversary tactics, this flaw can be leveraged within the MITRE ATT&CK framework under T1498 Network Denial of Service, specifically through resource exhaustion via logical flaws that cause service crashes. It may also touch upon T1055 Process Injection if an attacker could potentially exploit the memory corruption aspect to execute arbitrary code, although the primary reported impact is denial of service.
Mitigation strategies for this vulnerability involve updating DPDK and OVS-DPDK packages to versions where the integer underflow in vhost enqueue has been patched with proper bounds checking. Administrators should ensure that their virtualization hosts are running supported releases that include these security fixes. Additionally, implementing network-level filtering at the hypervisor or physical switch level can help prevent runt frames from reaching the DPDK-enabled interfaces if such traffic is not required for legitimate operations. For environments where OVS-DPDK is used in a shared capacity, it is advisable to review tenant configurations to ensure that virtual NICs are correctly configured and do not generate malformed packets due to driver bugs or misconfigurations. Regular patching cycles and monitoring of system logs for unexpected process terminations related to vhost processes are recommended operational practices to detect potential exploitation attempts early.