CVE-2020-10725: Dpdk Data Plane Development Kit

High severity, CVSS 7.7. EPSS: 2.2% chance of exploitation in the next 30 days.

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

Affected products

• Dpdk Data Plane Development Kit: up to and including 19.11
• Fedoraproject Fedora: version 32 only
• Opensuse Leap: version 15.1 only
• Oracle Enterprise Communications Broker: version 3.1.0 only; version 3.2.0 only

Published 2020-05-20. Last modified 2026-06-17.