CVE-2026-86845 — Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it,…
Published: 2026-10-14 · CVSS: 6.5 · CVSS 3.1
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7