CVE-2026-86849: Out-of-bounds Write in Red Hat Fast Datapath for RHEL 10

This vulnerability in Red Hat Fast Datapath for RHEL 10's DPDK lib/vhost vhost-crypto component arises from an integer overflow in chain length checks and missing length checks on the RSA path. These flaws can lead to an overflow of a host buffer in the vhost-crypto backend, potentially causing denial of service by impacting system availability. The CVSS 3.1 vector indicates the attack requires local access with low complexity and privileges, no user interaction, and the scope is changed. No known exploits are reported in the wild. The vendor advisory is available but does not explicitly state patch status.

The vulnerability can cause a host buffer overflow in the vhost-crypto backend, leading to potential denial of service (availability impact). There is no impact on confidentiality or integrity according to the CVSS vector. Exploitation requires local access with low privileges and no user interaction.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-86849 for current remediation guidance. No known exploits are reported in the wild. Until a patch is confirmed, limit local access to trusted users and monitor for unusual behavior related to the vhost-crypto component.