A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108342.json"