{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat Fast Datapath for RHEL 9: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--fast-datapath-for-rhel-9/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--fast-datapath-for-rhel-9/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 fixed in Debian 14",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 fixed in Debian 14",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 disclosed",
   "content_text": "A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 fixed in Debian 14",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.",
   "date_published": "2026-10-14T16:08:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 fixed in Debian 14",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:08:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:08:22Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86563/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86563/",
   "title": "CVE-2026-86563 disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.",
   "date_published": "2026-10-14T16:08:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86563/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86563/",
   "title": "CVE-2026-86563 fixed in Debian 14",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:08:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86563/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86563/",
   "title": "CVE-2026-86563 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:08:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86562/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86562/",
   "title": "CVE-2026-86562 disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.",
   "date_published": "2026-10-14T16:07:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86562/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86562/",
   "title": "CVE-2026-86562 fixed in Debian 14",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:07:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86562/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86562/",
   "title": "CVE-2026-86562 fixed in openSUSE Tumbleweed",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:07:58Z"
  }
 ]
}