Red Hat Product Security issued an important security advisory (RHSA-2026:11702) for ovn25.09 in Fast Datapath for Red Hat Enterprise Linux 9, addressing two vulnerabilities: CVE-2026-5265, a heap over-read in ICMP error response generation within OVN, and CVE-2026-5367, an information disclosure vulnerability triggered by crafted DHCPv6 packets. OVN provides virtual network abstraction capabilities complementing Open vSwitch. The advisory includes updated packages for multiple architectures and references Red Hat's official update article for remediation instructions. No CVSS scores are provided, but the severity is rated as high by the source data and important by Red Hat. No exploits in the wild are currently known.

The heap over-read vulnerability (CVE-2026-5265) could lead to potential memory safety issues during ICMP error response generation, possibly causing crashes or unintended behavior. The information disclosure vulnerability (CVE-2026-5367) could allow an attacker to gain unauthorized access to information via specially crafted DHCPv6 packets. Both issues affect the OVN component used for virtual network abstractions in Red Hat Fast Datapath. The advisory rates the security impact as important/high. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated ovn25.09 packages for Fast Datapath on Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires applying the vendor-provided patches. No alternative mitigations or workarounds are specified in the advisory.