A vulnerability was discovered in the DPDK lib/vhost component of Red Hat's Fast Datapath. The VDUSE handler does not clear vring pointers when the IOTLB is invalidated, causing a use‑after‑unmap condition (CWE‑416). This flaw can allow an attacker to dereference stale memory and potentially execute arbitrary code or corrupt data, thereby compromising confidentiality, integrity, and availability of the system.

Red Hat Enterprise Linux 10, 8 and 9, along with their Fast Datapath extensions; Red Hat OpenShift Container Platform 4; Red Hat OpenStack Platform 13 (Queens). Specific affected versions are not listed in the advisory. All these products include the DPDK lib/vhost component that is vulnerable.

The CVSS score of 8.8 marks this flaw as high severity. EPSS data is not available, and the vulnerability has not yet been listed in the CISA KEV catalog. The condition is a kernel‑level use‑after‑free that can be triggered via the VDUSE handler in the virtualization interface, meaning that an attacker with sufficient privilege or an attacker able to influence virtual machine traffic could exploit it. In the absence of an official fix, the risk remains until an update is released.