Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

Summary

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

Remediation

1. Inventory every Red Hat Fast Datapath for RHEL 10 deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://access.redhat.com/errata/RHSA-2026:94630
• Referencehttps://access.redhat.com/security/cve/CVE-2026-86562
• Referencehttps://bugzilla.redhat.com/show_bug.cgi?id=2529667
• Referencehttps://git.dpdk.org/dpdk/commit/?id=6ec17781346e0fe4b566b6bf8f79be71f87c10e4
• Referencehttps://access.redhat.com/errata/RHSA-2026:94629