Is CVE-2026-86845 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86845?

CVE-2026-86845 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-86845

Description

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.