Read the docs
TI-2020-08625 Aliases CVE-2020-10726GHSA-whmr-hj5c-pm9g

Integer overflow in [UNKNOWN] dpdk

Priority LOW 27CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.

Why it matters now

EPSS 0.00473 41st percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]dpdk20.02.1; 19.11.2—No fix listedCNA
  • dpdk Vendor[UNKNOWN] Affected 20.02.1; 19.11.2 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:*up to 19.11VulnerableDPDK
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
  • cpe:2.3:a:dpdk:data_plane_development_kit:*:*:*:*:*:*:*:* Versions up to 19.11 Vulnerable ·DPDK
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle

Remediation

Red Hat 2 advisories

  • RHSA-2020:4806 Released 2020-11-04 · Red Hat rating Important
    dpdk security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) dpdk-19.11.3-1.el8, dpdk-devel-19.11.3-1.el8, dpdk-doc-19.11.3-1.el8 +1
  • RHSA-2020:2295 Released 2020-05-26 · Red Hat rating Important
    openvswitch2.13 security, bug fix and enhancement update
    • Fast Datapath for Red Hat Enterprise Linux 8 network-scripts-openvswitch2.13-2.13.0-25.el8fdp.1, openvswitch2.13-2.13.0-25.el8fdp.1, openvswitch2.13-devel-2.13.0-25.el8fdp.1 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    [UNKNOWN] dpdk — openSUSE-SU-2020:0693

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2020-08624 A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a…Priority LOW 38
    • TI-2020-08622 Integer overflow in [UNKNOWN] dpdkPriority LOW 30
    • TI-2020-08621 Integer overflow in [UNKNOWN] dpdkPriority LOW 30
    Show all 5 records → Advisory →
  • Advisory ·

    [UNKNOWN] dpdk — FEDORA-2020-04e3d34451

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2020-08624 A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a…Priority LOW 38
    • TI-2020-08622 Integer overflow in [UNKNOWN] dpdkPriority LOW 30
    • TI-2020-08621 Integer overflow in [UNKNOWN] dpdkPriority LOW 30
    Show all 5 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Fast Datapath for Red Hat Enterprise Linux 8Fixed RHSA-2020:2295
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4806
Not affected: 9 products
  • Fast Datapath for RHEL 7
  • Fast Datapath for RHEL 8
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 4
  • Red Hat Enterprise Linux 7
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 15 (Stein)
  • Red Hat OpenStack Platform 16 (Train)
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10726
  2. 2026-10-03 Alias added: GHSA-whmr-hj5c-pm9g

References

Patch 2

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences