{"id":"CVE-2026-86567","state":"PUBLISHED","title":"Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap","description":"A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.","publishedAt":"2026-10-14T17:50:03.467Z","updatedAt":"2026-10-20T02:39:51.097Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Fast Datapath for RHEL 10","Red Hat Fast Datapath for RHEL 8","Red Hat Fast Datapath for RHEL 9","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat OpenStack Platform 13 (Queens)"],"affected":[{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.12","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.16","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13"]}],"references":["https://access.redhat.com/security/cve/CVE-2026-86567","https://bugzilla.redhat.com/show_bug.cgi?id=2529685"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/86xxx/CVE-2026-86567.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-86567","state":"PUBLISHED","datePublished":"2026-10-14T17:50:03.467Z","dateUpdated":"2026-10-20T02:39:51.097Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-09-08T02:56:53.901Z"},"containers":{"cna":{"title":"Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap","descriptions":[{"lang":"en","value":"A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap."}],"affected":[{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.12","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.16","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-86567","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529685","name":"RHBZ#2529685","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-20T02:39:51.097Z"},"datePublic":"2026-10-14T15:01:08.808Z","x_redhatCweChain":"CWE-416: Use After Free","workarounds":[{"lang":"en","value":"No mitigation is currently available."}],"timeline":[{"lang":"en","time":"2026-09-08T02:48:46.769Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-14T15:01:08.808Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Ivar Al-Safawi for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-15T15:09:51.246480Z","id":"CVE-2026-86567","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T15:10:26.570Z"}}]}}}