# CVE-2026-93683: DPDK vhost indirect descriptor table out-of-bounds access

Source: https://junglewise.ai/threats/cve-2026-93683-a-flaw-was-found-in-the-dpdk-vhost-library-when-handling-a-virtio  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-93683 · Severity: medium · CVSS 6.4 · Published 2026-10-14

DPDK is a software library that handles high-speed data packet processing in virtual machines. A flaw in how it validates indirect descriptor tables allows a guest virtual machine to trigger an out-of-bounds memory read or walk, potentially crashing or disrupting the host vhost process that mediates guest-to-host communication.

Technologies: [DPDK](https://junglewise.ai/threats/technologies/dpdk). Vendors: [DPDK](https://junglewise.ai/threats/vendors/dpdk).

## Quick answers

**Is CVE-2026-93683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93683 being exploited in the wild.

**How severe is CVE-2026-93683?** Medium severity, with a CVSS score of 6.4, published 14 October 2026.

**Which products and versions are affected?** DPDK versions prior to the fix in RHSA-2026:94629.

**Is there a fix for CVE-2026-93683?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93683 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-93683?** Check whether you run DPDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-of-check/time-of-use (TOCTOU) vulnerability exists in the vhost library's handling of virtio indirect descriptor tables: the host reads the table length from guest memory, allocates a host copy, then reads the length again—allowing a malicious guest to change the length between reads or supply an out-of-range index. This causes the vhost process to walk past validated memory boundaries. An attacker with guest-level access can crash or disrupt the vhost process; no payload is returned to the guest, but out-of-bounds bytes are consumed as descriptor fields for address translation.

## Affected products

- DPDK DPDK versions prior to the fix in RHSA-2026:94629

## Timeline

- 2026-10-14: disclosed
- 2026-11-03: advisory: Red Hat RHSA-2026:94629 security update issued

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:94629](https://access.redhat.com/errata/RHSA-2026:94629)

## Related threats

- [DPDK vhost-crypto integer overflow in lib/vhost](https://junglewise.ai/threats/cve-2026-86849-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-integer-overflow)
- [DPDK vhost-crypto indirect-descriptor double-fetch out-of-bounds](https://junglewise.ai/threats/cve-2026-86848-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-the-indirect)
- [DPDK vhost-crypto uninitialized pointer in write-back chain](https://junglewise.ai/threats/cve-2026-86847-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-write-back-chain)
- [DPDK vhost-crypto out-of-bounds write via unchecked descriptor index](https://junglewise.ai/threats/cve-2026-86846-a-flaw-was-found-in-dpdk-lib-vhost-vhost-crypto-a-guest-can)
- [DPDK lib/vhost use-after-free in VDUSE handler](https://junglewise.ai/threats/cve-2026-86567-a-flaw-was-found-in-dpdk-lib-vhost-the-vduse-handler-fails-to)