Quick answers
- Is CVE-2026-86561 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86561 being exploited in the wild.
- How severe is CVE-2026-86561?
- Medium severity, with a CVSS score of 6.5, published 14 October 2026.
- Which products and versions are affected?
- DPDK DPDK.
- Is there a fix for CVE-2026-86561?
- No fixed version is recorded yet. No mitigation is currently available; users should monitor for a patch release from the DPDK project.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-86561 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-86561?
- Check whether you run DPDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
No mitigation is currently available; users should monitor for a patch release from the DPDK project.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}]
Technical details
A missing memory size validation in DPDK lib/vhost prior to mmap during vhost memory-region setup allows a malicious guest that controls vhost-user memory table messages to trigger resource allocation without limits (CWE-770). The attacker requires local privileges to send crafted vhost-user messages and can trigger host denial of service through resource exhaustion or memory corruption. No fix is currently available.
Affected products
- DPDK DPDK