OVN, which provides virtual network abstractions complementing Open vSwitch, contains two security vulnerabilities. CVE-2026-5265 is a heap over-read occurring during ICMP error response generation, categorized under CWE-130. CVE-2026-5367 allows information disclosure through specially crafted DHCPv6 packets. Red Hat Product Security has released an update for the ovn-2021 package in the Fast Datapath for Red Hat Enterprise Linux 8 to remediate these issues. The advisory is identified as RHSA-2026:11694 and rates the security impact as Important.

The heap over-read vulnerability (CVE-2026-5265) could lead to potential memory safety issues, such as crashes or information leakage. The information disclosure vulnerability (CVE-2026-5367) could allow an attacker to obtain sensitive information by sending crafted DHCPv6 packets. Both vulnerabilities affect network virtualization components, potentially impacting the confidentiality and stability of virtual network environments using OVN on affected Red Hat Enterprise Linux Fast Datapath 8 systems.

Red Hat has released updated ovn-2021 packages for Fast Datapath on Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:11694 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.