A flaw was found in DPDK lib/vhost vhost-crypto. rte_vhost_crypto_fetch_requests() uses a guest avail-ring descriptor index as a vring descriptor-table index without checking it against vq->size. vhost_crypto_finalize_one_request() then indexes the used ring by that guest descriptor index instead of the used-ring position, allowing an out-of-bounds write.