A flaw in the DPDK lib/vhost component causes the memory size of a virtual host memory region to be insufficiently validated before performing an mmap. This omission can lead to memory corruption or a host crash, compromising system integrity and availability. The issue is classified as a memory allocation weakness (CWE‑770).

Affecting Red Hat Fast Datapath for RHEL 8, RHEL 9 and RHEL 10, Red Hat Enterprise Linux 8, 9 and 10, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens). Specific version details are not provided, so any system using the affected DPDK libraries may be vulnerable.

The CVSS score of 6.5 places this vulnerability in the medium severity range, with an EPSS of 0.158% (0.00158) indicating a very low probability of exploitation and it is not listed in CISA’s KEV catalog. Because the bug involves memory manipulation within the host, effective exploitation would typically require local code execution or a compromised host that can trigger the vhost memory‑region setup. The absence of an official workaround and the low EPSS exploitation data suggest that the risk is moderate but could be higher if an attacker already controls memory or can trigger the vhost setup. It is prudent to treat the vulnerability as a potential denial‑of‑service or integrity risk while awaiting patching.