A flaw was discovered in the DPDK vhost‑crypto component of Red Hat’s Fast Datapath. During session cleanup the code may leave a stale cached session pointer and does not verify the session type before re‑attaching it, which can trigger a use‑after‑free or type confusion scenario. If an attacker can influence the cleanup process from a guest VM, this could corrupt memory and potentially allow arbitrary code execution on the host. The weakness is identified as CWE‑825, a serious memory corruption vulnerability.

Affected products include Red Hat Enterprise Linux 8, 9 and 10 with Fast Datapath, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13. Version details are not publicly disclosed, so all current releases that contain the vhost‑crypto backend are considered vulnerable.

Based on the description, the attack vector is likely local, originating from a guest VM that can control vhost‑crypto operations on the host, and no additional prerequisites are specified beyond the ability to configure or attach a virtio‑crypto backend from an untrusted guest. The CVSS score of 6.5 indicates moderate severity, and the EPSS score of <1% suggests a very low exploitation probability; additionally, the vulnerability is not listed in the CISA KEV catalog. The attacker could potentially exploit this use‑after‑free or type confusion to corrupt memory or execute arbitrary code on the host.