Security feed

25 October 2026

advisoryOfficial CVE List25 Oct 2026

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-86848

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/22/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/23/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/24/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenStack Platform 13 (Queens)

Source reference: /containers/cna/affected/25/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-86848
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #23104 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:13:05 GMT
Publisher date: Wed, 14 Oct 2026 17:50:08 GMT

Read the original announcement

advisoryOfficial CVE List25 Oct 2026

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-86566

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/22/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/23/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/24/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenStack Platform 13 (Queens)

Source reference: /containers/cna/affected/25/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-86566
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #23103 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:13:04 GMT
Publisher date: Wed, 14 Oct 2026 17:52:01 GMT

Read the original announcement

advisoryOfficial CVE List25 Oct 2026

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93683

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 10

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 8

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Fast Datapath for RHEL 9

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/22/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenStack Platform 13 (Queens)

Source reference: /containers/cna/affected/23/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-93683
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #22869 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:09:32 GMT
Publisher date: Wed, 14 Oct 2026 15:42:35 GMT

Read the original announcement

24 October 2026

advisoryOfficial CVE List24 Oct 2026

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux for NVIDIA 26 Red Hat OpenShift Container Platform 4 Red Hat OpenShift Container Platform 4 Red Hat OpenStack Platform 13 (Queens)CVE-2026-93834

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93834

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 6

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 7

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux for NVIDIA 26

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Container Platform 4

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenStack Platform 13 (Queens)

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-93834
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #2087 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:12:52 GMT
Publisher date: Fri, 25 Sep 2026 13:36:17 GMT

Read the original announcement