On Mon, Apr 20, 2026 at 11:01 AM Ales Musil <amusil () redhat com> wrote: Description ===========
Multiple versions of OVN (Open Virtual Network) are vulnerable to crafted DHCPv6 packets that could potentially read out-of-bounds, leaking adjacent info stored on the heap.
OVN supports configuring DHCPv6 options for Logical Switch Ports. When configured we allow handling of DHCPv6 requests in a userspace thread called pinctrl. The thread accesses user-controlled packet data and copies some of it in the process of creating a reply packet.
When building a DHCPv6 ADVERTISE reply, the handler echoes the Client ID option using the option's self-declared length without validating it against the actual packet bounds. A workload can send a crafted DHCPv6 SOLICIT with an inflated Client ID length field, causing ovn-controller to copy heap memory beyond the valid packet data into the reply. The reply is then delivered back to the attacker's VM port.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the CVE-2026-5367 identifier to this issue.
A way to determine if any LSP has DHCPv6 options configured:
$ ovn-nbctl --columns name,dhcpv6options list logicalswitchport
If the above command returns at least one dhcpv6option, the Logical Switch Port is configured to respond to DHCPv6 SOLICIT messages.
Mitigation ==========
The only potential mitigation is to disable the DHCPv6 feature for workloads attached to OVN logical ports, e.g.:
ovn-nbctl clear logicalswitchport <workload-port> dhcpv6options.
We do not recommend mitigating the vulnerability this way because it will also disable legitimate DHCPv6 traffic originating from workloads connected to logical switch ports.
Fix ===
Patches to fix this vulnerability in OVN 24.03 and newer are applied to the appropriate branches.
Recommendation ==============
We recommend that users of OVN apply the patches, or upgrade to a known patched version of OVN. These include:
v24.03.8 v24.09.4 v25.03.3 v25.09.3 v26.03.1
Acknowledgments ===============
The OVN team wishes to thank the reporter:
Seiji Sakurai <Seiji.Sakurai () outlook com> One small correction: the 24.09 release is not happening so for 24.09 please upgrade to the next available release.
On Mon, Apr 20, 2026 at 11:01 AM Ales Musil <amusil () redhat com> wrote: Description ===========
Multiple versions of OVN (Open Virtual Network) are vulnerable to crafted IP packets that could potentially read out-of-bounds, leaking adjacent info stored on the heap.
OVN supports sending ICMP error messages in multiple scenarios, e.g. reject ACLs, PMTU discovery via Gateway MTU, Load Balancer without any backends that are configured to reject a packet. The ICMP error is generated in the userspace thread called pinctrl. The thread accesses user-controlled packet data and copies some of it in the process of creating a reply packet.
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (iptotlen for IPv4, ip6plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the workload.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the CVE-2026-5265 identifier to this issue. A way to determine if any reject ACL is configured:
$ ovn-nbctl --columns match,action find acl action=reject
If the command above returns at least one ACL, the Logical Switch configured with that ACL rejects packets matching the condition.
A way to determine if a Gateway MTU is configured:
$ ovn-nbctl --columns name,options list logicalrouterport
If the output from the command above returns at least one Logical Router Port with gatewaymtu in the options column, that port is configured to perform the MTU check.
A way to determine if a Load Balancer has a reject action: $ ovn-nbctl --columns name,options list loadbalancer
If the output from the command above returns at least one Load Balancer with gatewaymtu in the options column, that Load Balancer is configured to reject the traffic if it lacks any backends.
Mitigation ==========
The only potential mitigation is to remove or disable all affected ACLs, Load Balancers or Gateway MTU settings on Logical Router Ports.
We do not recommend mitigating the vulnerability this way because it will also affect legitimate traffic going through the cluster.
Fix ===
Patches to fix this vulnerability in OVN 24.03 and newer are applied to the appropriate branches.
Recommendation ==============
We recommend that users of OVN apply tthe patches, or upgrade to a known patched version of OVN. These include:
v24.03.8 v24.09.4 v25.03.3 v25.09.3 v26.03.1
Acknowledgments ===============
The OVN team wishes to thank the reporter:
Seiji Sakurai <Seiji.Sakurai () outlook com> One small correction: the 24.09 release is not happening so for 24.09 please upgrade to the next available release.
Description ===========
Multiple versions of OVN (Open Virtual Network) are vulnerable to crafted DHCPv6 packets that could potentially read out-of-bounds, leaking adjacent info stored on the heap.
OVN supports configuring DHCPv6 options for Logical Switch Ports. When configured we allow handling of DHCPv6 requests in a userspace thread called pinctrl. The thread accesses user-controlled packet data and copies some of it in the process of creating a reply packet.
When building a DHCPv6 ADVERTISE reply, the handler echoes the Client ID option using the option's self-declared length without validating it against the actual packet bounds. A workload can send a crafted DHCPv6 SOLICIT with an inflated Client ID length field, causing ovn-controller to copy heap memory beyond the valid packet data into the reply. The reply is then delivered back to the attacker's VM port.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the CVE-2026-5367 identifier to this issue.
A way to determine if any LSP has DHCPv6 options configured:
$ ovn-nbctl --columns name,dhcpv6options list logicalswitchport
If the above command returns at least one dhcpv6option, the Logical Switch Port is configured to respond to DHCPv6 SOLICIT messages.
Mitigation ==========
The only potential mitigation is to disable the DHCPv6 feature for workloads attached to OVN logical ports, e.g.:
ovn-nbctl clear logicalswitchport <workload-port> dhcpv6options.
We do not recommend mitigating the vulnerability this way because it will also disable legitimate DHCPv6 traffic originating from workloads connected to logical switch ports.
Fix ===
Patches to fix this vulnerability in OVN 24.03 and newer are applied to the appropriate branches.
Recommendation ==============
We recommend that users of OVN apply the patches, or upgrade to a known patched version of OVN. These include:
v24.03.8 v24.09.4 v25.03.3 v25.09.3 v26.03.1
Acknowledgments ===============
The OVN team wishes to thank the reporter:
Seiji Sakurai <Seiji.Sakurai () outlook com>
Description ===========
Multiple versions of OVN (Open Virtual Network) are vulnerable to crafted IP packets that could potentially read out-of-bounds, leaking adjacent info stored on the heap.
OVN supports sending ICMP error messages in multiple scenarios, e.g. reject ACLs, PMTU discovery via Gateway MTU, Load Balancer without any backends that are configured to reject a packet. The ICMP error is generated in the userspace thread called pinctrl. The thread accesses user-controlled packet data and copies some of it in the process of creating a reply packet.
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (iptotlen for IPv4, ip6plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the workload.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the CVE-2026-5265 identifier to this issue. A way to determine if any reject ACL is configured:
$ ovn-nbctl --columns match,action find acl action=reject
If the command above returns at least one ACL, the Logical Switch configured with that ACL rejects packets matching the condition.
A way to determine if a Gateway MTU is configured:
$ ovn-nbctl --columns name,options list logicalrouterport
If the output from the command above returns at least one Logical Router Port with gatewaymtu in the options column, that port is configured to perform the MTU check.
A way to determine if a Load Balancer has a reject action: $ ovn-nbctl --columns name,options list loadbalancer
If the output from the command above returns at least one Load Balancer with gatewaymtu in the options column, that Load Balancer is configured to reject the traffic if it lacks any backends.
Mitigation ==========
The only potential mitigation is to remove or disable all affected ACLs, Load Balancers or Gateway MTU settings on Logical Router Ports.
We do not recommend mitigating the vulnerability this way because it will also affect legitimate traffic going through the cluster.
Fix ===
Patches to fix this vulnerability in OVN 24.03 and newer are applied to the appropriate branches.
Recommendation ==============
We recommend that users of OVN apply tthe patches, or upgrade to a known patched version of OVN. These include:
v24.03.8 v24.09.4 v25.03.3 v25.09.3 v26.03.1
Acknowledgments ===============
The OVN team wishes to thank the reporter:
Seiji Sakurai <Seiji.Sakurai () outlook com>
A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.