Skip to content
Fencer Vulns
medium 6.5

CVE-2026-5265 json

Ovn: ovn: heap over-read in icmp error response generation

published 2026-04-24 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-25420

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Patch / fix

  • Red Hat Fast Datapath for Red Hat Enterprise Linux 10 0:25.03.2-100.el10fdp, 0:25.09.2-103.el10fdp
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 0:21.12.0-145.el8fdp, 0:23.06.4-30.el8fdp
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 0:23.06.4-30.el9fdp, 0:23.09.6-16.el9fdp, 0:24.03.7-82.el9fdp, 0:25.03.2-100.el9fdp, 0:25.09.2-103.el9fdp
  • ovn25.03 RHEL 10 25.03.2-100.el10fdp
  • ovn25.03-host RHEL 10 25.03.2-100.el10fdp
  • ovn25.03-vtep RHEL 10 25.03.2-100.el10fdp
  • ovn25.03-central RHEL 10 25.03.2-100.el10fdp
  • ovn25.09 RHEL 10 25.09.2-103.el10fdp
  • ovn25.09-host RHEL 10 25.09.2-103.el10fdp
  • ovn25.09-vtep RHEL 10 25.09.2-103.el10fdp
  • ovn25.09-central RHEL 10 25.09.2-103.el10fdp

red hat advisories RHSA-2026:22110RHSA-2026:22111RHSA-2026:11702RHSA-2026:11701RHSA-2026:11698RHSA-2026:11700

  • openvswitch Linux Micro 6.1 3.1.7-slfo.1.1_4.1
  • openvswitch SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +3 more 2.14.2-150400.24.35.1
  • openvswitch3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 3.1.7-150500.3.31.1
  • openvswitch SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7 3.5.4-150700.41.18.1
  • openvswitch SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.4-160000.4.1
  • openvswitch Linux Micro 6.0 3.1.7-6.1
  • openvswitch SLES for SAP 15 SP6, SLES 15 SP6-LTSS 3.1.7-150600.33.15.1

suse advisories SUSE-SU-2026:23188-1SUSE-SU-2026:2481-1SUSE-SU-2026:2476-1SUSE-SU-2026:2475-1SUSE-SU-2026:2463-1SUSE-SU-2026:22145-1

  • openvswitch openSUSE Leap 16.0 3.5.4-160000.4.1
  • openvswitch openSUSE Tumbleweed 3.7.1-34.1

opensuse advisories openSUSE-SU-2026:20972-1openSUSE-SU-2026:10956-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5265 updated cvss 6.5

ovn: ovn: Heap Over-Read in ICMP Error Response Generation

  • Red Hat Fast Datapath for RHEL 7 ovn2.11, ovn2.12, ovn2.13, ovn2.11-host, ovn2.11-vtep, ovn2.12-host, +6 more Red Hat Fast Datapath for RHEL 8 ovn2.11, ovn2.12, ovn2.13, ovn22.03, ovn22.06, ovn22.09, +26 more Red Hat Fast Datapath for RHEL 9 ovn-2021, ovn22.03, ovn22.06, ovn22.09, ovn22.12, ovn23.03, +22 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 ovn23.06 23.06.4-30.el8fdp, ovn-2021 21.12.0-145.el8fdp, ovn23.06-host 23.06.4-30.el8fdp, ovn23.06-vtep 23.06.4-30.el8fdp, ovn-2021-host 21.12.0-145.el8fdp, ovn-2021-vtep 21.12.0-145.el8fdp, +2 more
    fixed: vendor fix RHSA-2026:11694
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 ovn23.06 23.06.4-30.el9fdp, ovn23.09 23.09.6-16.el9fdp, ovn24.03 24.03.7-82.el9fdp, ovn25.03 25.03.2-100.el9fdp, ovn25.09 25.09.2-103.el9fdp, ovn23.06-host 23.06.4-30.el9fdp, +14 more
    fixed: vendor fix RHSA-2026:11696
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 10 ovn25.03 25.03.2-100.el10fdp, ovn25.09 25.09.2-103.el10fdp, ovn25.03-host 25.03.2-100.el10fdp, ovn25.03-vtep 25.03.2-100.el10fdp, ovn25.09-host 25.09.2-103.el10fdp, ovn25.09-vtep 25.09.2-103.el10fdp, +2 more
    fixed: vendor fix RHSA-2026:22110

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

  • Red Hat Fast Datapath for Red Hat Enterprise Linux 10
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9
  • Red Hat Fast Datapath for RHEL 7
  • Red Hat Fast Datapath for RHEL 8
  • Red Hat Fast Datapath for RHEL 9

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.