CVE-2026-5265: Ovn: ovn: heap over-read in icmp error response generation
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (iptotlen for IPv4, ip6plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Where feasible, change ACLs/security-group rules that currently use a 'reject' action to 'drop' so that short packets with inflated IP length fields cannot reliably trigger ovn-controller to generate ICMP Destination Unreachable or Packet Too Big responses.
ovn-controller / OVN ACLs ACL action for rejected traffic = drop (instead of reject) - Compensating control
At the network edge or hypervisor level, block or filter ICMP error responses (ICMP Destination Unreachable / Packet Too Big) originating from ovn-controller to tenant VMs, or apply rate-limiting/inspection to such ICMP error messages to reduce exposure until an upstream fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5265?
CVE-2026-5265 is classified as a high-severity vulnerability due to potential impacts on system security.
How do I fix CVE-2026-5265?
To fix CVE-2026-5265, update to the latest version of Open vSwitch that includes the security patch.
What systems are affected by CVE-2026-5265?
CVE-2026-5265 specifically affects the Open vSwitch ovn-controller software.
What type of vulnerability is CVE-2026-5265?
CVE-2026-5265 is a heap over-read vulnerability related to ICMP error response generation.
Can CVE-2026-5265 lead to information disclosure?
Yes, CVE-2026-5265 can potentially lead to information disclosure due to improper handling of ICMP responses.