{"id":"CVE-2026-86845","state":"PUBLISHED","title":"Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup","description":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.","publishedAt":"2026-10-14T17:52:06.749Z","updatedAt":"2026-10-15T14:50:01.364Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Fast Datapath for RHEL 10","Red Hat Fast Datapath for RHEL 8","Red Hat Fast Datapath for RHEL 9","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat OpenStack Platform 13 (Queens)"],"affected":[{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.12","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.16","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13"]}],"references":["https://access.redhat.com/security/cve/CVE-2026-86845","https://bugzilla.redhat.com/show_bug.cgi?id=2529844"],"weaknesses":["CWE-825"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/86xxx/CVE-2026-86845.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-86845","state":"PUBLISHED","datePublished":"2026-10-14T17:52:06.749Z","dateUpdated":"2026-10-15T14:50:01.364Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-09-08T14:54:06.881Z"},"containers":{"cna":{"title":"Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup","descriptions":[{"lang":"en","value":"A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend."}],"affected":[{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 10","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.12","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.15","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.16","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 8","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"grout","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Fast Datapath for RHEL 9","packageName":"openvswitch3.6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::fastdatapath"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"dpdk","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch2.17","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openvswitch3.1","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","packageName":"openvswitch","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-86845","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529844","name":"RHBZ#2529844","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-825","description":"Expired Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-14T17:52:06.749Z"},"datePublic":"2026-10-14T15:01:17.409Z","x_redhatCweChain":"CWE-825: Expired Pointer Dereference","workarounds":[{"lang":"en","value":"Do not attach a virtio-crypto vhost-user backend to untrusted guests."}],"timeline":[{"lang":"en","time":"2026-09-08T12:39:30.106Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-14T15:01:17.409Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Anthropic Research for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-15T14:46:12.188388Z","id":"CVE-2026-86845","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T14:50:01.364Z"}}]}}}