CVE-2026-86567: Use After Free in Red Hat Fast Datapath for RHEL 10

This vulnerability involves a use-after-free condition in the VDUSE handler of the DPDK lib/vhost component used in Red Hat Fast Datapath for RHEL 10. Specifically, the handler fails to invalidate vring pointers upon IOTLB invalidation, which can lead to dereferencing freed memory (use-after-unmap). This flaw can be exploited to cause severe impacts on system confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The vulnerability is publicly disclosed with a Red Hat advisory available, but no explicit patch or affected versions are detailed in the provided information.

The vulnerability allows an attacker with local privileges to exploit a use-after-free condition, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates low attack complexity and privileges required, no user interaction, and scope change, making it a high-impact flaw if exploited.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-86567 for current remediation guidance. Until a patch is applied, limit access to trusted users with local privileges and monitor for updates from Red Hat. No vendor statement indicates the vulnerability is already mitigated or requires no action.