# CVE-2026-100236: DPDK GSO library out-of-bounds read/write in header copy

Source: https://junglewise.ai/threats/cve-2026-100236-a-flaw-was-found-in-the-dpdk-gso-library-when-software-gso  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-100236 · Severity: high · CVSS 8.6 · Published 2026-10-14

The Data Plane Development Kit (DPDK) is a library used by networking applications to process data packets efficiently. A flaw in its Generic Segmentation Offload (GSO) feature fails to validate that packet headers fit within buffer boundaries, allowing a remote attacker or malicious virtual machine to send crafted packets that trigger memory corruption. This can lead to application crashes or potential code execution without authentication.

Technologies: [DPDK Project DPDK](https://junglewise.ai/threats/technologies/dpdk-project-dpdk). Vendors: [DPDK Project](https://junglewise.ai/threats/vendors/dpdk-project).

## Quick answers

**Is CVE-2026-100236 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100236 being exploited in the wild.

**How severe is CVE-2026-100236?** High severity, with a CVSS score of 8.6, published 14 October 2026.

**Which products and versions are affected?** DPDK Project DPDK.

**Is there a fix for CVE-2026-100236?** No fixed version is recorded yet. Do not run software GSO on untrusted packets. Alternatively, size the direct memory pool larger than the maximum header size (approximately 208 bytes for tunneled headers), though this does not fully mitigate short-first-segment over-read scenarios.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100236 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100236?** Check whether you run DPDK Project DPDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not run software GSO on untrusted packets. Alternatively, size the direct memory pool larger than the maximum header size (approximately 208 bytes for tunneled headers), though this does not fully mitigate short-first-segment over-read scenarios.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14"}]

## Technical details

The vulnerability is an out-of-bounds read/write (CWE-787) in the DPDK GSO library's header-copy routine. When processing packets with software GSO, the code does not validate that header length fits in the source segment or destination buffer; a header longer than the configured GSO segment size causes payload-size calculation underflow. An unauthenticated remote or guest-supplied packet processed with software GSO can trigger the memory corruption, affecting systems that enable rte_gso_segment or testpmd with --enable-gso on untrusted packet sources.

## Affected products

- DPDK Project DPDK

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-100236](https://access.redhat.com/security/cve/CVE-2026-100236)

## Related threats

- [DPDK nfp vDPA driver buffer overflow in virtqueue handling](https://junglewise.ai/threats/cve-2026-86856-a-flaw-was-found-in-the-dpdk-nfp-vdpa-driver-stack-and-heap)
- [DPDK vhost-crypto use-after-free in session cleanup](https://junglewise.ai/threats/cve-2026-86845-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-session-cleanup)