This advisory covers two security vulnerabilities in ovn23.09, a component of Red Hat's Fast Datapath for RHEL 9. The first vulnerability (CVE-2026-5265) is a heap over-read occurring during ICMP error response generation, categorized under CWE-130. The second vulnerability (CVE-2026-5367) involves information disclosure triggered by crafted DHCPv6 packets. Both vulnerabilities could potentially impact the confidentiality and stability of the virtual network abstraction system. Red Hat has released updated ovn23.09 packages to address these issues. The advisory references Red Hat's errata RHSA-2026:11698 for detailed patching instructions and package versions.

The vulnerabilities could lead to a heap over-read, which may cause application instability or crashes, and information disclosure through crafted DHCPv6 packets, potentially exposing sensitive data. Red Hat classifies the security impact as Important, indicating a high severity level but not critical. No active exploitation has been reported, reducing immediate risk but warranting timely patching to prevent potential abuse.

Red Hat has released updated ovn23.09 packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux Fast Datapath 9 versions should apply the security update as detailed in Red Hat advisory RHSA-2026:11698. The vendor provides official patches and instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official update.