A TOCTOU double‑fetch flaw in DPDK’s vhost control‑queue handler can trigger a heap buffer overflow on the host when attacker‑controlled data is supplied through the VDUSE control‑queue. This race‑condition weakness (CWE‑362) can corrupt arbitrary memory and potentially lead to arbitrary code execution on the host system, compromising confidentiality, integrity, and availability.

Affected Red Hat offerings include Fast Datapath for RHEL 8, 9 and 10, the underlying RHEL 8, 9 and 10 operating systems, OpenShift Container Platform 4, and the OpenStack Platform 13 (Queens). No specific version strings are listed, so any installation of these products before the patch is potentially vulnerable.

The CVSS base score of 7.8 indicates high severity, with the potential to expose or modify confidential or system state data or compromise availability. The EPSS score is listed as less than 1%, suggesting that active exploitation of this vulnerability is very unlikely and that it is not widely targeted at present. The vulnerability is not in the CISA KEV catalog, and no public exploit is known. Attackers would likely need to interact with the host via a virtual machine or container that can submit malicious descriptors to the vhost control‑queue; by exploiting the TOCTOU double‑fetch, an attacker could cause a heap buffer overflow and potentially execute arbitrary code on the host.