Skip to content
Fencer Vulns
medium 6.4

CVE-2026-93683 json

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

published 2026-10-14 25 d ago modified 2026-11-09 4 h ago also EUVD-2026-101306

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 2:25.11-2.el10_2
  • Red Hat Red Hat Enterprise Linux 8 0:23.11-3.el8_10
  • Red Hat Red Hat Enterprise Linux 9 2:25.11-2.el9_8
  • dpdk Debian 13 24.11.8-0+deb13u1
  • dpdk Debian 14 25.11.4-1

debian advisories DEBIAN-CVE-2026-93683

  • dpdk openSUSE Tumbleweed 25.11.4-1.1

opensuse advisories openSUSE-SU-2026:12151-1

  • dpdk AlmaLinux 8 23.11-3.el8_10
  • dpdk-tools AlmaLinux 8 23.11-3.el8_10
  • dpdk AlmaLinux 9 2:25.11-2.el9_8
  • dpdk-tools AlmaLinux 9 2:25.11-2.el9_8
  • dpdk AlmaLinux 10 2:25.11-2.el10_2
  • dpdk-tools AlmaLinux 10 2:25.11-2.el10_2

almalinux advisories ALSA-2026:96083ALSA-2026:94629ALSA-2026:94630

  • dpdk Rocky Linux 10 2:25.11-2.el10_2
  • dpdk Rocky Linux 9 2:25.11-2.el9_8

rocky linux advisories RLSA-2026:94630RLSA-2026:94629

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-93683 updated cvss 6.4

dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU

  • Red Hat Fast Datapath for RHEL 8 openvswitch3.1, openvswitch2.11, openvswitch2.12, openvswitch2.13, openvswitch2.15, openvswitch2.16, +27 more Red Hat Fast Datapath for RHEL 9 openvswitch3.0, openvswitch3.1, openvswitch3.2, openvswitch3.3, openvswitch3.4, openvswitch3.5, +26 more Red Hat Fast Datapath for RHEL 10 openvswitch3.5, openvswitch3.6, openvswitch3.5-test, openvswitch3.6-test, openvswitch3.5-ipsec, openvswitch3.6-ipsec, +2 more Red Hat OpenShift Container Platform 4 openvswitch3.0, openvswitch3.1, openvswitch2.17, openvswitch3.0-test, openvswitch3.1-test, openvswitch2.17-test, +7 more Red Hat OpenStack Platform 13 (Queens) openvswitch, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, openvswitch-ovn-common, +1 more
    affected: workaround, no fix available “No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests.”
  • Red Hat Enterprise Linux AppStream (v. 8) dpdk 23.11-3.el8_10, dpdk-tools 23.11-3.el8_10
    fixed: vendor fix “No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests.” RHSA-2026:96083
  • Red Hat Enterprise Linux AppStream (v. 9) dpdk 25.11-2.el9_8, dpdk-tools 25.11-2.el9_8
    fixed: vendor fix “No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests.” RHSA-2026:94629
  • Red Hat Enterprise Linux AppStream (v. 10) dpdk 25.11-2.el10_2, dpdk-tools 25.11-2.el10_2
    fixed: vendor fix “No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests.” RHSA-2026:94630
  • Red Hat Enterprise Linux CRB (v. 8) dpdk-devel 23.11-3.el8_10, dpdk-debuginfo 23.11-3.el8_10, dpdk-debugsource 23.11-3.el8_10
    fixed: vendor fix “No runtime mitigation. QEMU indirect_desc=off does not help: libvhost honours VRING_DESC_F_INDIRECT anyway. Do not expose vhost-user to untrusted guests.” RHSA-2026:96083

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
25 d ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Fast Datapath for RHEL 10
  • Red Hat Fast Datapath for RHEL 8
  • Red Hat Fast Datapath for RHEL 9
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenStack Platform 13 (Queens)

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.