CVE-2026-86566
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Oct 14, 2026
CISA due date
—
The record
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121727 Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body… CWE-191
- CVE-2026-61497 TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report… CWE-191
- CVE-2026-120060 psqlODBC trusts counts and lengths in server data in three places. CWE-191
- CVE-2026-120058 psqlODBC sizes its row cache from the column count of a cursor's first result, but… CWE-191
- CVE-2026-20576 In afe, there is a possible out of bounds write due to a missing bounds check. CWE-191
- CVE-2026-20572 In adsp, there is a possible out of bounds write due to an integer overflow. CWE-191
- CVE-2026-111735 P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). CWE-191
- CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session… CWE-191