Quick answers
- Is CVE-2026-86856 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86856 being exploited in the wild.
- How severe is CVE-2026-86856?
- Medium severity, with a CVSS score of 6.5, published 14 October 2026.
- Which products and versions are affected?
- DPDK Project DPDK 23.11 LTS and later, confirmed in 24.11.
- Is there a fix for CVE-2026-86856?
- No fixed version is recorded yet. Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted guests to an NFP VF running with class=vdpa.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-86856 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-86856?
- Check whether you run DPDK Project DPDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted guests to an NFP VF running with class=vdpa.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}]
Technical details
The DPDK nfp vDPA PMD driver allocates buffers sized for a single queue pair but fails to validate the number of virtqueues being configured, leading to out-of-bounds write (CWE-787). A guest with low privilege access to an NFP vDPA device can trigger buffer overflow on the host. As of the advisory date, no fix is available; patches are under review.
Affected products
- DPDK Project DPDK 23.11 LTS and later, confirmed in 24.11