CVE-2026-5265: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-5265 is a heap over-read vulnerability in OVN (Open Virtual Network) affecting the ICMP error response generation logic in ovn-controller. When generating ICMP Destination Unreachable or Packet Too Big responses, the handler uses the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size, allowing a VM to trigger out-of-bounds heap memory reads. The vulnerability was reported by Seiji Sakurai, disclosed publicly on April 20, 2026 via the oss-security mailing list, and assigned CVE-2026-5265 by Red Hat. It carries a CVSS v3.1 base score of 6.5 (Medium) (oss-security Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). The vulnerable code path resides in the pinctrl userspace thread of ovn-controller, which processes packets sent up from the dataplane and generates ICMP error replies. When constructing the ICMP error body, the handler copies data from the original packet using the IP header's self-declared length field without cross-checking it against the actual buffer length — a classic length parameter inconsistency. An attacker controlling a VM can craft a short IP packet with an inflated ip_tot_len (IPv4) or ip6_plen (IPv6) field and trigger an ICMP error condition (e.g., by matching a reject ACL, hitting a Gateway MTU check, or targeting a Load Balancer with no backends configured to reject), causing ovn-controller to read beyond the valid packet buffer and embed adjacent heap memory into the ICMP response returned to the VM (oss-security Advisory, Red Hat Bugzilla).

Successful exploitation allows a VM tenant to leak arbitrary heap memory contents from the ovn-controller process via crafted ICMP error responses, resulting in a confidentiality impact (low, as heap contents are partially exposed) and a potential availability impact (high, as the out-of-bounds read could destabilize the controller process). The leaked heap data may contain sensitive information such as packet payloads from other tenants, internal network state, or cryptographic material, posing a risk in multi-tenant cloud environments. Integrity is not directly affected, but the information disclosure could facilitate further attacks against the virtual network infrastructure (oss-security Advisory, Red Hat RHSA-2026:11694).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires the attacker to control a VM within an OVN-managed network and requires that at least one of the following be configured: a reject ACL, a Gateway MTU on a Logical Router Port, or a Load Balancer with a reject action — conditions common in production deployments. The EPSS score is approximately 0.042% (very low probability of exploitation in the near term). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection plugins are available in Nessus (IDs: 307605, 311110, 311112, 311113, 311125, 318073, 319577) and Qualys (oss-security Advisory, Feedly).

1. Reconnaissance: Identify an OVN-managed environment where the attacker controls at least one VM. Confirm that a reject ACL, Gateway MTU, or Load Balancer reject action is configured using ovn-nbctl --columns match,action find acl action=reject or equivalent commands.
2. Craft malicious packet: Construct a short IP packet (e.g., minimal payload) with an inflated ip_tot_len (IPv4) or ip6_plen (IPv6) field set to a value much larger than the actual packet buffer size.
3. Trigger ICMP error: Send the crafted packet from the controlled VM toward a destination or port that will trigger an ICMP Destination Unreachable or Packet Too Big response from ovn-controller (e.g., traffic matching a reject ACL or exceeding a configured Gateway MTU).
4. Receive ICMP response: Capture the ICMP error response returned to the VM. The response body will contain data copied from beyond the valid packet buffer — i.e., adjacent heap memory from the ovn-controller process.
5. Extract leaked data: Parse the ICMP error body to extract heap memory contents, which may include packet data from other tenants, internal OVN state, or other sensitive information (oss-security Advisory).

• Network: Unusual ICMP Destination Unreachable or Packet Too Big packets returned to VMs with oversized or anomalous error bodies; IP packets from VMs with ip_tot_len or ip6_plen values significantly larger than the actual packet size.
• Logs: ovn-controller logs showing unexpected packet processing errors or memory access anomalies in the pinctrl thread; repeated ICMP error generation events triggered by the same source VM.
• Process: Abnormal memory usage or crashes in the ovn-controller process; core dumps from ovn-controller indicating out-of-bounds memory access (oss-security Advisory).

The recommended remediation is to upgrade OVN to one of the patched versions: v24.03.8, v25.03.3, v25.09.3, or v26.03.1 (note: v24.09 branch users should upgrade to the next available release). Red Hat has issued security advisories for Fast Datapath on RHEL 8 (RHSA-2026:11694, RHSA-2026:11695), RHEL 9 (RHSA-2026:11696, RHSA-2026:11698, RHSA-2026:11700, RHSA-2026:11701, RHSA-2026:11702), and RHEL 10 (RHSA-2026:22110, RHSA-2026:22111). As a temporary workaround, reject ACLs, Gateway MTU settings on Logical Router Ports, and Load Balancer reject actions can be disabled, though this is not recommended as it disrupts legitimate traffic. Operators should verify their configuration using the ovn-nbctl commands provided in the advisory to assess exposure (oss-security Advisory, Red Hat RHSA-2026:11694, Red Hat Bugzilla).

The vulnerability was disclosed by Ales Musil of the OVN team via the oss-security mailing list on April 20, 2026, crediting reporter Seiji Sakurai. The disclosure included detailed mitigation guidance and patched version information. Security aggregators including SecurityOnline.info and VulDB covered the advisory shortly after disclosure. Social media activity on Bluesky (infosec.skyfleet.blue) noted the advisory on the day of publication (oss-security Advisory, SecurityOnline).