The flaw in the DPDK vhost library permits a guest to manipulate the length of an indirect descriptor table between two consecutive reads performed by the host. Because the host validates the length only after allocating a host buffer, a guest can perform a race that causes the host to walk beyond the bounds of the mapped memory or heap copy. The impact is an out‑of‑bounds byte read that may crash or disrupt the vhost process. The failure occurs when the victim processes a virtio indirect descriptor table; it does not return payload data to the guest, so the attack does not provide direct data exfiltration but effectively disconnects the affected virtual machine. This flaw is a classic bounds-override, identified as CWE-367.

Affected products include Red Hat Fast Datapath for Red Hat Enterprise Linux 8, 9 and 10, the Red Hat Enterprise Linux kernels, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens). All current releases of these products deploy the vulnerable DPDK vhost library; the vendor has not defined a narrower version scope.

The CVSS score of 6.4 marks the issue as a moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited. A privileged guest that can craft an indirect descriptor table with a manipulated length can trigger an out‑of‑bounds access, causing the vhost process to crash or become unresponsive and thereby denying service to all guests attached to that instance. Current information indicates that there is no effective runtime mitigation; disabling indirect descriptors at the hypervisor level does not prevent the fault, so the only practical mitigation is to apply the vendor supplied patch.