CVE-2026-86845
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Oct 14, 2026
CISA due date
—
The record
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-41216 An invalid pointer dereference vulnerability exists in the… CWE-825
- CVE-2026-42057 An invalid pointer dereference vulnerability exists in the… CWE-825
- CVE-2026-53918 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. CWE-825
- CVE-2026-104039 A flaw was found in SSSD. CWE-825
- CVE-2026-104034 A flaw was found in SSSD. CWE-825
- CVE-2026-102010 A flaw was found in GCC. CWE-825
- CVE-2026-76891 Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CWE-825
- CVE-2026-76890 Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CWE-825