A flaw in the DPDK lib/vhost vhost‑crypto component allows a guest operating system to present an arbitrary avail‑ring descriptor index that the host consumes without bounds checking, resulting in an out‑of‑bounds write in the host vhost‑crypto backend. This defect can corrupt host memory, potentially affecting the stability or integrity of the host."

Affected systems include Red Hat Fast Datapath for RHEL 8, 9, 10; Red Hat Enterprise Linux 8, 9, 10; Red Hat OpenShift Container Platform 4; and Red Hat OpenStack Platform 13 (Queens). No specific patch levels or version ranges are provided; any installation that contains the vhost‑crypto component is potentially vulnerable until an update is applied.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known compromises. Based on the description, it is inferred that an attacker must be able to operate a guest that can send a crafted avail‑ring descriptor index to the host’s vhost‑crypto backend. The attack requires no inherent host privileges and relies on the guest’s ability to influence the backend. While the impact is limited to host memory corruption, no specific exploitation to privilege escalation or remote code execution is documented in the CVE record.