The vulnerability occurs when generating ICMP Destination Unreachable or Packet Too Big responses. The handler copies part of the original packet into the ICMP error body using the IP header's declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without verifying it against the actual packet buffer size. A malicious VM can send a short packet with an inflated IP length field that triggers an ICMP error, causing ovn-controller to read heap memory beyond valid packet data and include it in the ICMP response. This may lead to unintended information disclosure and impact system availability.

The vulnerability can lead to the disclosure of heap memory contents in ICMP error messages sent back to the VM, potentially leaking sensitive information. Additionally, the CVSS vector indicates a high impact on availability (A:H) and a low impact on confidentiality (C:L), with no impact on integrity. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5265 for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider restricting untrusted VM traffic that could trigger ICMP error generation to reduce exposure.