CVE-2026-5265 Ovn: ovn: heap over-read in icmp error response generation - security issue
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
Problem types: cwe_id: CWE-130
description: Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 7
cpes: cpe:/o:redhat:enterprise_linux:7::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 8
cpes: cpe:/o:redhat:enterprise_linux:8::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
vendor: Red Hat
product: Fast Datapath for RHEL 9
cpes: cpe:/o:redhat:enterprise_linux:9::fastdatapath
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
version: 3.1
Published: 2026-04-24T12:25:06.808Z