ICMP Vulnerability in OVN Controller Affects Red Hat Products

CVE-2026-5265

What is CVE-2026-5265?

A vulnerability exists in the OVN Controller when generating ICMP responses, specifically in handling Destination Unreachable or Packet Too Big messages. The issue arises as the handler relies on the IP header's declared total length without properly validating it against the actual buffer size. This oversight allows for exploitation by sending a deliberately short packet with a misleading IP length field. Consequently, the OVN Controller may process memory beyond the limits of valid packet data, potentially leading to information disclosure through the ICMP error message returned to the originating VM.

References