Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by redhat

CVE-2026-100236Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

High 8.6

In plain English

A high-severity out-of-bounds write in Fast Datapath for RHEL 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.4%top 65.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10dpdk2:25.11-2.el10_2ALSA-2026:94630
AlmaLinux:9dpdk2:25.11-2.el9_8ALSA-2026:94629
AlmaLinux:10dpdk-devel2:25.11-2.el10_2ALSA-2026:94630
AlmaLinux:9dpdk-devel2:25.11-2.el9_8ALSA-2026:94629
AlmaLinux:10dpdk-doc2:25.11-2.el10_2ALSA-2026:94630
AlmaLinux:9dpdk-doc2:25.11-2.el9_8ALSA-2026:94629
AlmaLinux:10dpdk-tools2:25.11-2.el10_2ALSA-2026:94630
AlmaLinux:9dpdk-tools2:25.11-2.el9_8ALSA-2026:94629
Debian:12dpdkno fix listedDEBIAN-CVE-2026-100236
Debian:13dpdk24.11.8-0+deb13u1DEBIAN-CVE-2026-100236
Debian:14dpdk25.11.4-1DEBIAN-CVE-2026-100236
Rocky Linux:10dpdk2:25.11-2.el10_2RLSA-2026:94630
Rocky Linux:9dpdk2:25.11-2.el9_8RLSA-2026:94629
Ubuntu:22.04:LTSdpdkno fix listedUBUNTU-CVE-2026-100236
Ubuntu:24.04:LTSdpdkno fix listedUBUNTU-CVE-2026-100236
Ubuntu:26.04:LTSdpdkno fix listedUBUNTU-CVE-2026-100236
Ubuntu:26.10dpdkno fix listedUBUNTU-CVE-2026-100236

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for RHEL 10 see references
Red Hat Fast Datapath for RHEL 10 see references
Red Hat Fast Datapath for RHEL 10 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenStack Platform 13 (Queens) see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References