CVE-2026-5265: Ovn: ovn: heap over-read in icmp error response generation

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-24 · updated 2026-10-26
Weakness: CWE-130

Description

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Affected products

Red Hat Fast Datapath for Red Hat Enterprise Linux 10: all versions — fixed in 0:25.03.2-100.el10fdp, 0:25.09.2-103.el10fdp
Red Hat Fast Datapath for Red Hat Enterprise Linux 8: all versions — fixed in 0:21.12.0-145.el8fdp, 0:23.06.4-30.el8fdp
Red Hat Fast Datapath for Red Hat Enterprise Linux 9: all versions — fixed in 0:23.06.4-30.el9fdp, 0:23.09.6-16.el9fdp, 0:24.03.7-82.el9fdp, 0:25.03.2-100.el9fdp, 0:25.09.2-103.el9fdp
Red Hat Fast Datapath for RHEL 7: all versions
Red Hat Fast Datapath for RHEL 8: all versions
Red Hat Fast Datapath for RHEL 9: all versions

How to fix

Upgrade to a fixed version: Red Hat Fast Datapath for Red Hat Enterprise Linux 10 0:25.03.2-100.el10fdp, 0:25.09.2-103.el10fdp; Red Hat Fast Datapath for Red Hat Enterprise Linux 8 0:21.12.0-145.el8fdp, 0:23.06.4-30.el8fdp; Red Hat Fast Datapath for Red Hat Enterprise Linux 9 0:23.06.4-30.el9fdp, 0:23.09.6-16.el9fdp, 0:24.03.7-82.el9fdp, 0:25.03.2-100.el9fdp. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-5265 or the next vulnerability affects your stack