Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in DPDK lib/vhost vhost-crypto. vhost_crypto_close_sess() frees a cryptodev session without invalidating the per-device session cache, so a later request with the same session id uses a dangling pointer. The data path also attaches vhost_session->sym or vhost_session->asym without checking the session type, so an asymmetric session can be treated as symmetric.