CVE-2026-86848: Time-of-check Time-of-use (TOCTOU) Race Condition in Red Hat Fast Datapath for RHEL 10
Description
CVE-2026-86848 is a high severity TOCTOU race condition vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. It involves a double-fetch of a guest descriptor next index, which can lead to an out-of-bounds access in the host backend when exploited by a malicious guest.
CVSS v3.1
Score 8.8high
Affected software
Red Hat
Fast Datapath for RHEL 10
Red Hat
Fast Datapath for RHEL 8
Red Hat
Fast Datapath for RHEL 9
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat OpenShift Container Platform 4
Red Hat
Red Hat OpenStack Platform 13 (Queens)
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from a time-of-check time-of-use (TOCTOU) race condition in the indirect-descriptor snapshot mechanism of the DPDK lib/vhost vhost-crypto component. Specifically, the double-fetch of a guest descriptor next index allows a malicious guest to trigger an out-of-bounds memory access in the host backend, potentially compromising confidentiality, integrity, and availability of the host system.
Potential Impact
Successful exploitation can lead to high impact including full compromise of confidentiality, integrity, and availability of the host system running Red Hat Fast Datapath for RHEL 10. The out-of-bounds access may allow an attacker to execute arbitrary code or cause denial of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-86848 for current remediation guidance. No explicit patch or workaround details are provided in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-08T14:54:19.899Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-86848","vendor":"Red Hat"}]
Threat ID: 6acfc4752cdf04f6569de05c
Added to database: 10/14/2026, 18:05:41 UTC
Last enriched: 10/14/2026, 18:18:15 UTC
Last updated: 10/14/2026, 19:00:31 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.