CVE-2026-5265: Improper Handling of Length Parameter Inconsistency in Red Hat Fast Datapath for Red Hat Enterprise Linux 10
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
AI Analysis
Technical Summary
The vulnerability arises from OVN's ICMP error response generation code copying data based on the IP header's self-declared total length without validating it against the actual packet buffer size. This allows a crafted short packet with an inflated IP length field to trigger an ICMP error response that reads heap memory beyond the valid packet data, leaking potentially sensitive information. The issue affects OVN implementations in Red Hat Enterprise Linux Fast Datapath 8. Red Hat has issued security advisories RHSA-2026:11694 and RHSA-2026:11695 providing patches for OVN versions 21.12 and 23.06 respectively. The CVSS v3.1 base score is 6.5 (medium severity) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H, indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.
Potential Impact
An attacker controlling a VM can send specially crafted packets with inconsistent IP length fields to trigger ovn-controller to read beyond the valid packet buffer when generating ICMP error responses. This can lead to information disclosure of heap memory contents and potentially cause denial of service due to memory handling errors. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released official security updates fixing this vulnerability in OVN versions 21.12 and 23.06 for Red Hat Enterprise Linux Fast Datapath 8. Users should apply the updates provided in advisories RHSA-2026:11694 and RHSA-2026:11695 as detailed in https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying these official patches.
CVE-2026-5265: Improper Handling of Length Parameter Inconsistency in Red Hat Fast Datapath for Red Hat Enterprise Linux 10
Description
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from OVN's ICMP error response generation code copying data based on the IP header's self-declared total length without validating it against the actual packet buffer size. This allows a crafted short packet with an inflated IP length field to trigger an ICMP error response that reads heap memory beyond the valid packet data, leaking potentially sensitive information. The issue affects OVN implementations in Red Hat Enterprise Linux Fast Datapath 8. Red Hat has issued security advisories RHSA-2026:11694 and RHSA-2026:11695 providing patches for OVN versions 21.12 and 23.06 respectively. The CVSS v3.1 base score is 6.5 (medium severity) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H, indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.
Potential Impact
An attacker controlling a VM can send specially crafted packets with inconsistent IP length fields to trigger ovn-controller to read beyond the valid packet buffer when generating ICMP error responses. This can lead to information disclosure of heap memory contents and potentially cause denial of service due to memory handling errors. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released official security updates fixing this vulnerability in OVN versions 21.12 and 23.06 for Red Hat Enterprise Linux Fast Datapath 8. Users should apply the updates provided in advisories RHSA-2026:11694 and RHSA-2026:11695 as detailed in https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying these official patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-03-31T17:33:09.225Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-5265","vendor":"Red Hat"}]
Threat ID: 69eb6ac987115cfb68343e73
Added to database: 04/24/2026, 13:06:17 UTC
Last enriched: 06/18/2026, 17:10:00 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 125
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.