CVE-2026-86561: Allocation of Resources Without Limits or Throttling in Red Hat Fast Datapath for RHEL 10

This vulnerability arises from inadequate validation of memory size parameters before performing mmap operations in the vhost memory-region setup within the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. This flaw can lead to resource allocation without limits or throttling, potentially causing host crashes or memory corruption. The CVSS 3.1 score is 6.5 (medium), with an attack vector limited to local access and requiring low privileges but no user interaction. The vendor advisory is available but does not explicitly state patch or remediation status in the provided data.

Successful exploitation can result in denial of service through host crashes or memory corruption. There is no indication of confidentiality or integrity impact. The attack requires local access with low privileges, limiting remote exploitation potential. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-86561 for current remediation guidance. Until a fix is applied, limit local access to trusted users and monitor for unusual system behavior related to memory management in the affected component.