CVE-2026-5265

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Score
CVSS 3.1 6.5 Medium
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-04-24
Last modified
2026-10-26
Weaknesses
CWE-130

Affected products

References

 
 
© AVABIS GmbH privacypolicy about