Redpacketsecurity CVE-2026-100236 Flaw in Red Hat DPDK GSO Library
Article Content
- •CVE-2026-100236 allows remote attackers to exploit DPDK GSO library vulnerabilities.
- •Heap memory corruption can lead to crashes or potential code execution without elevated privileges.
- •Immediate action is required to disable software GSO on untrusted traffic to mitigate risks.
A significant vulnerability, CVE-2026-100236, has been identified in the DPDK GSO library affecting Red Hat environments. This flaw allows unauthenticated remote attackers or guest virtual machines to cause heap memory corruption through out-of-bounds reads or writes. The vulnerability arises when software GSO processes packets from untrusted sources, potentially leading to process crashes or code execution without elevated privileges. Affected systems include those utilizing DPDK applications with software GSO enabled, particularly in virtual switching and cloud environments. The flaw was published on October 14, 2026, and is rated with a CVSS score of 8.6, indicating a high severity. Administrators are advised to disable software GSO on untrusted packets and increase the direct pool size to mitigate risks. No confirmed exploitation has been reported yet, but the vulnerability poses a significant risk to service availability and infrastructure stability.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Red Hat and CVE-2026-100236 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What systems are affected by CVE-2026-100236?
What immediate actions should be taken?
Is there a patch available for this vulnerability?
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…