ELSA-2026-94629: Security update for 4 packages

ELSA-2026-94629, released November 7, 2026, fixes 14 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

8.8

Base score, 0 to 10

Highest EPSS

0.0040

34th percentile

Priority of the 14 CVEs

Patch now 0
                                Urgent 0
                                High 14
                                Routine 0

Fixed package versions

Product	Release	Fixed in
dpdk	ol 9	2:25.11-2.el9_8
dpdk-devel	ol 9	2:25.11-2.el9_8
dpdk-doc	ol 9	2:25.11-2.el9_8
dpdk-tools	ol 9	2:25.11-2.el9_8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-100236	Dpdk: dpdk: heap out-of-bounds read/write in gso header copy	8.8	0.0040	None reported
High	CVE-2026-86563	dpdk: A flaw was found in DPDK lib/vhost	8.8	0.0020	None reported
High	CVE-2026-86847	Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup	8.8	0.0020	None reported
High	CVE-2026-86561	dpdk: A flaw was found in DPDK lib/vhost	8.8	0.0019	None reported
High	CVE-2026-86846	dpdk: A flaw was found in DPDK lib/vhost vhost-crypto	8.8	0.0019	None reported
High	CVE-2026-86567	Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap	8.8	0.0019	None reported
High	CVE-2026-86562	Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)	8.8	0.0018	None reported
High	CVE-2026-86566	dpdk: A flaw was found in DPDK lib/vhost	8.8	0.0017	None reported
High	CVE-2026-86856	dpdk: A flaw was found in the DPDK nfp vDPA driver	8.8	0.0017	None reported
High	CVE-2026-86565	Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write	8.8	0.0017	None reported
High	CVE-2026-86845	dpdk: A flaw was found in DPDK lib/vhost vhost-crypto	8.8	0.0017	None reported
High	CVE-2026-86849	dpdk: A flaw was found in DPDK lib/vhost vhost-crypto	8.8	0.0014	None reported
High	CVE-2026-93683	dpdk: A flaw was found in the DPDK vhost library	8.8	0.0011	None reported
High	CVE-2026-86848	dpdk: A flaw was found in DPDK lib/vhost vhost-crypto	8.8	0.0011	None reported

Also fixes CVE-2026-100236

ELSA-2026-94630
dpdk, dpdk-devel, dpdk-doc and 1 more on ol 10
ALSA-2026:94629
dpdk, dpdk-devel, dpdk-doc and 1 more on almalinux 9
ALSA-2026:94630
dpdk, dpdk-devel, dpdk-doc and 1 more on almalinux 10
RLSA-2026:94629
dpdk on rocky 9
RLSA-2026:94630
dpdk on rocky 10
RHSA-2026:94629
dpdk, dpdk-devel, dpdk-doc and 1 more on RHEL 9
RHSA-2026:94630
dpdk on RHEL 10
DEBIAN-CVE-2026-100236
dpdk on Debian 13.5 (trixie), Debian 14

Vendor advisory

https://linux.oracle.com/errata/ELSA-2026-94629.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/elsa-2026-94629">ELSA-2026-94629 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.