CVE-2026-5265
Full vulnerability record from the local CVENow database.
Description
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-04-24 13:16:21.770000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-5265",
"sourceIdentifier": "[email protected]",
"published": "2026-04-24T13:16:21.770",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM."
},
{
"lang": "es",
"value": "Al generar una respuesta ICMP de Destino Inalcanzable o Paquete Demasiado Grande, el gestor copia una porción del paquete original en el cuerpo del error ICMP utilizando la longitud total autodeclarada del encabezado IP (ip_tot_len para IPv4, ip6_plen para IPv6) sin validarla contra el tamaño real del búfer del paquete. Una VM puede enviar un paquete corto con un campo de longitud IP inflado que activa un error ICMP (p. ej., al alcanzar una ACL de rechazo), lo que provoca que ovn-controller lea memoria de pila más allá de los datos válidos del paquete y la incluya en la respuesta ICMP enviada de vuelta a la VM."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn25.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10::fastdatapath"
],
"versions": [
{
"version": "0:25.03.2-100.el10fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn25.09",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10::fastdatapath"
],
"versions": [
{
"version": "0:25.09.2-103.el10fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn-2021",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
],
"versions": [
{
"version": "0:21.12.0-145.el8fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn23.06",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
],
"versions": [
{
"version": "0:23.06.4-30.el8fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn23.06",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
],
"versions": [
{
"version": "0:23.06.4-30.el9fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn23.09",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
],
"versions": [
{
"version": "0:23.09.6-16.el9fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn24.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
],
"versions": [
{
"version": "0:24.03.7-82.el9fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn25.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
],
"versions": [
{
"version": "0:25.03.2-100.el9fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn25.09",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
],
"versions": [
{
"version": "0:25.09.2-103.el9fdp",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn2.11",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn2.12",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn2.13",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn2.11",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn2.12",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn2.13",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.06",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.09",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.12",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn23.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn-2021",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.06",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.09",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn22.12",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn23.03",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
},
{
"vendor": "Red Hat",
"product": "Fast Datapath for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ovn24.09",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9::fastdatapath"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 4.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-24T18:19:52.126823Z",
"id": "CVE-2026-5265",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-130"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:11694",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11695",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11696",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11698",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11700",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11701",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11702",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:22110",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:22111",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5265",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453458",
"source": "[email protected]"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/20/2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/20/4",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}