# CVE-2026-86856: DPDK nfp vDPA driver buffer overflow in virtqueue handling

Source: https://junglewise.ai/threats/cve-2026-86856-a-flaw-was-found-in-the-dpdk-nfp-vdpa-driver-stack-and-heap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-86856 · Severity: medium · CVSS 6.5 · Published 2026-10-14

A flaw in DPDK's nfp vDPA driver allows stack and heap buffers to overflow when virtual network queues are misconfigured, potentially causing system crashes or memory corruption. A guest virtual machine with access to an NFP vDPA device can trigger this vulnerability, risking denial of service or potential code execution in the host.

Technologies: [DPDK Project DPDK](https://junglewise.ai/threats/technologies/dpdk-project-dpdk). Vendors: [DPDK Project](https://junglewise.ai/threats/vendors/dpdk-project).

## Quick answers

**Is CVE-2026-86856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86856 being exploited in the wild.

**How severe is CVE-2026-86856?** Medium severity, with a CVSS score of 6.5, published 14 October 2026.

**Which products and versions are affected?** DPDK Project DPDK 23.11 LTS and later, confirmed in 24.11.

**Is there a fix for CVE-2026-86856?** No fixed version is recorded yet. Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted guests to an NFP VF running with class=vdpa.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86856 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-86856?** Check whether you run DPDK Project DPDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted guests to an NFP VF running with class=vdpa.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-14"}]

## Technical details

The DPDK nfp vDPA PMD driver allocates buffers sized for a single queue pair but fails to validate the number of virtqueues being configured, leading to out-of-bounds write (CWE-787). A guest with low privilege access to an NFP vDPA device can trigger buffer overflow on the host. As of the advisory date, no fix is available; patches are under review.

## Affected products

- DPDK Project DPDK 23.11 LTS and later, confirmed in 24.11

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-86856](https://access.redhat.com/security/cve/CVE-2026-86856)

## Related threats

- [DPDK vhost-crypto use-after-free in session cleanup](https://junglewise.ai/threats/cve-2026-86845-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-session-cleanup)
- [DPDK GSO library out-of-bounds read/write in header copy](https://junglewise.ai/threats/cve-2026-100236-a-flaw-was-found-in-the-dpdk-gso-library-when-software-gso)