CVE-2026-86565 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat products, including Fast Datapath for RHEL 8, 9, 10, Red Hat Enterprise Linux 8, 9, 10, and Red Hat OpenShift Container Platform 4, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-86565 is a high-severity vulnerability in DPDK lib/vhost affecting multiple Red Hat products. Defenders should prioritize verifying affected versions and applying patches or mitigations to prevent potential exploitation.

• Potential out-of-bounds write in the host vhost process
• Possible disruption to services using affected Red Hat products
• Need for verification of affected versions and application of patches or mitigations

Technical summary

A flaw in DPDK lib/vhost allows a guest to desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. This issue affects multiple Red Hat products, including Fast Datapath for RHEL 8, 9, 10, Red Hat Enterprise Linux 8, 9, 10, and Red Hat OpenShift Container Platform 4. The vulnerability is caused by a lack of proper synchronization between the guest and host, allowing an attacker to manipulate the virtqueue size and descriptor table size. This can lead to an out-of-bounds write in the host vhost, of

Defensive priority

Defenders should prioritize verifying affected versions and applying patches or mitigations provided by Red Hat, as this issue has a high CVSS score of 8.2.

Recommended defensive actions

• Verify affected Red Hat products and versions in your environment
• Apply patches or mitigations provided by Red Hat
• Monitor for potential exploitation attempts
• Review and update incident response plans

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about this issue. Red Hat has also provided a source reference for this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.