CVE-2026-5265

Ovn: ovn: heap over-read in icmp error response generation

State: Published
Severity: 6.5 Medium
Published: Apr 24, 2026
Updated: Jun 17, 2026
Reserved: Mar 31, 2026

Description

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H	redhat

Weaknesses

CWE-130 Improper Handling of Length Parameter Inconsistency

Affected Products

Product	Versions
Fast Datapath for Red Hat Enterprise Linux 10Red Hat	0:25.03.2-100.el10fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 10Red Hat	0:25.09.2-103.el10fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 8Red Hat	0:21.12.0-145.el8fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 8Red Hat	0:23.06.4-30.el8fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 9Red Hat	0:23.06.4-30.el9fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 9Red Hat	0:23.09.6-16.el9fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 9Red Hat	0:24.03.7-82.el9fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 9Red Hat	0:25.03.2-100.el9fdp and laterNot affected
Fast Datapath for Red Hat Enterprise Linux 9Red Hat	0:25.09.2-103.el9fdp and laterNot affected
Fast Datapath for RHEL 7Red Hat
Fast Datapath for RHEL 7Red Hat
Fast Datapath for RHEL 7Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 8Red Hat
Fast Datapath for RHEL 9Red Hat
Fast Datapath for RHEL 9Red Hat
Fast Datapath for RHEL 9Red Hat
Fast Datapath for RHEL 9Red Hat
Fast Datapath for RHEL 9Red Hat
Fast Datapath for RHEL 9Red Hat
Fast Datapath for RHEL 9Red Hat

References

RHSA-2026:11694vendor-advisory
RHSA-2026:11695vendor-advisory
RHSA-2026:11696vendor-advisory
RHSA-2026:11698vendor-advisory
RHSA-2026:11700vendor-advisory
RHSA-2026:11701vendor-advisory
RHSA-2026:11702vendor-advisory
RHSA-2026:22110vendor-advisory
RHSA-2026:22111vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-5265vdb-entry
RHBZ#2453458issue-tracking
http://www.openwall.com/lists/oss-security/2026/04/20/2
http://www.openwall.com/lists/oss-security/2026/04/20/4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.