# CVE-2026-86845: DPDK vhost-crypto use-after-free in session cleanup

Source: https://junglewise.ai/threats/cve-2026-86845-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-session-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-86845 · Severity: medium · CVSS 6.5 · Published 2026-10-14

DPDK is a packet processing library used in network appliances and virtualized environments. A flaw in its vhost-crypto component allows a guest virtual machine with access to a virtio-crypto device to crash the host or potentially execute code by exploiting stale session pointers. This affects deployments that enable vhost-crypto with untrusted guest workloads.

Technologies: [DPDK Project DPDK](https://junglewise.ai/threats/technologies/dpdk-project-dpdk). Vendors: [DPDK Project](https://junglewise.ai/threats/vendors/dpdk-project).

## Quick answers

**Is CVE-2026-86845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86845 being exploited in the wild.

**How severe is CVE-2026-86845?** Medium severity, with a CVSS score of 6.5, published 14 October 2026.

**Which products and versions are affected?** DPDK Project DPDK.

**Is there a fix for CVE-2026-86845?** No fixed version is recorded yet. Do not attach a virtio-crypto vhost-user backend to untrusted guests. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86845 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-86845?** Check whether you run DPDK Project DPDK. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not attach a virtio-crypto vhost-user backend to untrusted guests.

## Technical details

A use-after-free and type confusion vulnerability exists in DPDK's lib/vhost vhost-crypto backend where session cleanup leaves a stale cached session pointer that the data path fails to validate before use. An attacker with access to a virtio-crypto vhost-user device can trigger the flaw to cause denial of service or potential code execution. The vulnerability is triggered by local attack vector with low privilege requirements.

## Affected products

- DPDK Project DPDK

## Timeline

- 2026-10-14: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-86845](https://access.redhat.com/security/cve/CVE-2026-86845)

## Related threats

- [DPDK nfp vDPA driver buffer overflow in virtqueue handling](https://junglewise.ai/threats/cve-2026-86856-a-flaw-was-found-in-the-dpdk-nfp-vdpa-driver-stack-and-heap)
- [DPDK GSO library out-of-bounds read/write in header copy](https://junglewise.ai/threats/cve-2026-100236-a-flaw-was-found-in-the-dpdk-gso-library-when-software-gso)