CVE-2026-5367 is an information disclosure vulnerability in OVN (Open Virtual Network) within Red Hat Enterprise Linux Fast Datapath 8. The issue arises from improper handling of length parameter inconsistencies in DHCPv6 SOLICIT packets, where an attacker can send packets with an inflated Client ID length. This causes the ovn-controller to read beyond the intended packet bounds, resulting in a heap over-read and disclosure of sensitive information to the attacker's virtual machine port. The vulnerability is tracked as CWE-130 (Improper Handling of Length Parameter). Red Hat has issued security advisories RHSA-2026:11694 and RHSA-2026:11695 providing updated ovn packages that fix this issue. The updates are available for multiple architectures including x86_64, ppc64le, s390x, and aarch64. The CVSS v3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation of this vulnerability allows a remote attacker to cause the ovn-controller to read beyond packet boundaries, leading to disclosure of sensitive heap memory contents. This information disclosure can compromise confidentiality of data handled by the affected system. There is no impact on integrity or availability reported. The vulnerability can be exploited remotely without authentication or user interaction.

Red Hat has released official security updates for ovn-2021 and ovn23.06 packages that address CVE-2026-5367. Users of Red Hat Enterprise Linux Fast Datapath 8 should apply these updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the vendor-provided patches fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the security update.