Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by redhat

CVE-2026-5265Ovn: ovn: heap over-read in icmp error response generation

Medium 6.5

In plain English

A medium-severity security flaw in Fast Datapath for Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 49.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ovnno fix listedDEBIAN-CVE-2026-5265
Debian:13ovnno fix listedDEBIAN-CVE-2026-5265
Ubuntu:22.04:LTSovnno fix listedUBUNTU-CVE-2026-5265
Ubuntu:24.04:LTSovnno fix listedUBUNTU-CVE-2026-5265
Ubuntu:25.10ovnno fix listedUBUNTU-CVE-2026-5265
Ubuntu:26.04:LTSovnno fix listedUBUNTU-CVE-2026-5265
Ubuntu:26.10ovnno fix listedUBUNTU-CVE-2026-5265

Affected products (as reported)

VendorProductVersions
Red Hat Fast Datapath for Red Hat Enterprise Linux 10 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 10 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 8 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 8 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for Red Hat Enterprise Linux 9 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 7 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 8 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references
Red Hat Fast Datapath for RHEL 9 see references

Weakness: CWE-130 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

References