CVE-2026-5265

Name	CVE-2026-5265
Description	When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1134486

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ovn (PTS)	bookworm	23.03.1-1~deb12u2	vulnerable
	trixie	25.03.0-1	vulnerable
	forky	26.03.0-2	vulnerable
	sid	26.03.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ovn	source	(unstable)	26.03.0-4			1134486

Notes

https://www.openwall.com/lists/oss-security/2026/04/20/2
Introduced with: https://github.com/ovn-org/ovn/commit/c2339d87268d748da9a44aaefbb6d1ecc490b99d (v20.03.0)
Fixed by: https://github.com/ovn-org/ovn/commit/9d674c684a56aef12c53b1e4596b6eded23a0402 (v26.03.1)