Red Hat Fast Datapath For Rhel 10 vulnerabilities

15 CVEs affecting Red Hat Fast Datapath For Rhel 10, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86856, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-100236, published 2026-10-14. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and…
CVE-2026-86565, published 2026-10-14. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
CVE-2026-86563, published 2026-10-14. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
CVE-2026-86847, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang…
CVE-2026-86846, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto…
CVE-2026-86561, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
CVE-2026-86562, published 2026-10-14. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
CVE-2026-86567, published 2026-10-14. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVE-2026-86564, published 2026-09-08. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
CVE-2026-86856, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

Latest

CVE-2026-86849, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
CVE-2026-86848, published 2026-10-14. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host…
CVE-2026-86845, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to…
CVE-2026-86566, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.