A flaw was found in DPDK lib/vhost. (CVE-2026-86564)

CVE-2026-86564 describes a vulnerability in the DPDK lib/vhost where the virtio-net control queue handler does not perform length validation before reading command_data. This missing validation can cause improper memory access, classified under CWE-125 (Out-of-bounds Read). The vulnerability affects numerous Ubuntu-packaged versions of DPDK ranging from 2.0.0-0ubuntu1 through 25.11.3-1. The CVSS 3.1 score is 3.3, indicating low severity, with an attack vector limited to local access, low complexity, and requiring low privileges without user interaction. The impact is limited to availability (denial of service), with no confidentiality or integrity impact reported. No known exploits or patches are documented in the provided information.

The vulnerability can cause a denial of service condition due to missing length validation in the virtio-net control queue handler. There is no reported impact on confidentiality or integrity. The attack vector is local with low complexity and low privileges required. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, limiting local access to the affected component may reduce risk.