CVE-2026-86564

Publication date 10 September 2026

Last updated 11 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

3.3 · Low

Score breakdown

Description

Missing length validation before reading command_data in virtio-net control queue handler

Read the notes from the security team

Status

Package Ubuntu Release Status
dpdk 26.04 LTS resolute
Vulnerable, fix deferred
24.04 LTS noble
Vulnerable, fix deferred
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred

Notes

mdeslaur

no fix available form dpdk developers as of 2026-09-11

Severity score breakdown

CVSS version: CVSS v3.0

Base score 3.3 · Low

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

Other references

Access our resources on patching vulnerabilities