CVE-2026-5265

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Apr 24, 2026
Source updated: Jun 17, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Ovn: ovn: heap over-read in icmp error response generation

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Fast Datapath for Red Hat Enterprise Linux 10

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 10
Platforms: Unknown
Default status: affected
Package: ovn25.03
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 10 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:25.03.2-100.el10fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 10

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 10
Platforms: Unknown
Default status: affected
Package: ovn25.09
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 10 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:25.09.2-103.el10fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 8

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 8
Platforms: Unknown
Default status: affected
Package: ovn-2021
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:21.12.0-145.el8fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 8

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 8
Platforms: Unknown
Default status: affected
Package: ovn23.06
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:23.06.4-30.el8fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 9

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 9
Platforms: Unknown
Default status: affected
Package: ovn23.06
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:23.06.4-30.el9fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 9

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 9
Platforms: Unknown
Default status: affected
Package: ovn23.09
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:23.09.6-16.el9fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 9

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 9
Platforms: Unknown
Default status: affected
Package: ovn24.03
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:24.03.7-82.el9fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 9

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 9
Platforms: Unknown
Default status: affected
Package: ovn25.03
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:25.03.2-100.el9fdp	`unaffected`	rpm	*	Unavailable	None listed

Fast Datapath for Red Hat Enterprise Linux 9

Vendor: Red Hat
Product: Fast Datapath for Red Hat Enterprise Linux 9
Platforms: Unknown
Default status: affected
Package: ovn25.09
Package collection: https://access.redhat.com/downloads/content/package-browser/

Fast Datapath for Red Hat Enterprise Linux 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:25.09.2-103.el9fdp	`unaffected`	rpm	*	Unavailable	None listed