A bug in the DPDK library’s vhost component allows a guest operating system that holds run‑time RX descriptors to underflow the copy length field when enqueueing to a shared vhost. This results in the vhost backend, such as OVS‑DPDK, terminating unexpectedly, which can cause a service interruption for the affected VM or network services. The weakness is an integer underflow (CWE‑191). The flaw can be triggered only by a virtualized guest that can manipulate RX descriptors in the shared memory region used by the vhost driver, so the attack is limited to a virtualized environment where the guest has sufficient privileges to exercise the vhost path.

Red Hat Fast Datapath on RHEL 8, 9, 10; Red Hat Enterprise Linux 8, 9, 10; Red Hat OpenShift Container Platform 4; Red Hat OpenStack Platform 13 (Queens). These products use the lib/vhost component of DPDK that hosts the vulnerable copy length logic.

The CVSS score of 6.5 indicates a moderate severity vulnerability. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, meaning current exploitation activity is unknown. The attack vector is likely limited to a privileged guest in a shared vhost environment, requiring the guest to configure or use runt RX descriptors. In environments where the vulnerable vhost backend (e.g., OVS‑DPDK) is in use, an attacker could cause a denial of service for the guest and any dependent services.