Bug 2529846 (CVE-2026-86846)

Summary: CVE-2026-86846 dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, echaudro, eglynn, fleitner, jdelft, jjoyce, jpretori, jschluet, jupierce, ktraynor, lgarciaa, lhh, mbiarnes, mburns, mgarciac, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rkhan, security-response-team, sfaye, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2552432, 2552433, 2552434, 2552435, 2552436, 2552437    
Bug Blocks:    
Deadline: 2026-12-08   

Description OSIDB Bzimport 2026-09-08 14:48:13 UTC 
A flaw was found in DPDK lib/vhost vhost-crypto. rte_vhost_crypto_fetch_requests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhost_crypto_finalize_one_request() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.