Executive brief
DPDK is a data plane development kit used in high-performance networking applications. A missing validation check in the virtio-net control-queue handler can allow a malicious guest to trigger an out-of-bounds memory read, causing the host process to crash and result in service unavailability.
Technical details
This is an out-of-bounds read vulnerability (CWE-125) in DPDK's lib/vhost component, specifically in the virtio-net control-queue handler. The flaw stems from missing length validation before reading command_data, allowing an attacker to read memory beyond allocated buffer boundaries. Attack vector is local; a malicious guest with access to the VDUSE virtio-net control virtqueue can trigger this flaw. Successful exploitation causes a host process crash (denial of service), and the out-of-bounds read may also leak sensitive information such as memory addresses. No mitigation is currently available; a patch is expected from the DPDK project.
Affected products
- DPDK DPDK <unknown>
Timeline
- 2026-09-08: disclosed