{"id":"AZL-108339","summary":"CVE-2026-100236 affecting package dpdk 23.11.3-1","details":"A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.","modified":"2026-10-19T05:35:54Z","published":"2026-10-14T17:17:44Z","upstream":["CVE-2026-100236"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100236"}],"affected":[{"package":{"name":"dpdk","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/dpdk"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"23.11.3-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108339.json"}}],"schema_version":"1.9.0"}