Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in the DPDK nfp vDPA driver. Vring, VFIO MSI-X, and epoll buffers are sized for NFP_VDPA_MAX_QUEUES (one queue pair), but start and interrupt paths use unbounded rte_vhost_get_vring_num(). A guest or vhost-user frontend that presents more than two virtqueues can overflow stack and heap in the host vDPA backend.