Every CVE Search/ Get API key

CVE-2026-5265

Ovn: ovn: heap over-read in icmp error response generation

6.5 Medium

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

0.63%Up 0.6 points since Apr 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Ovn: ovn: heap over-read in icmp error response generation

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Record
CVE-2026-5265
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-130
Updated
2026-11-02
EUVDEUVD-2026-25420 6.5

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Record
EUVD-2026-25420
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-whr7-6788-jg2p 6.5

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a...

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Record
GHSA-whr7-6788-jg2p
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-130
Updated
2026-11-02
NVD 6.5

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Record
CVE-2026-5265
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-130
Updated
2026-11-02
OSVDEBIAN-CVE-2026-5265 6.5

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Record
DEBIAN-CVE-2026-5265
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:11694 8.6

Red Hat Security Advisory: ovn-2021 security update

Record
RHSA-2026:11694
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
Show 19 moreShow less
OSVRHSA-2026:11695 8.6

Red Hat Security Advisory: ovn23.06 security update

Record
RHSA-2026:11695
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11696 8.6

Red Hat Security Advisory: ovn23.06 security update

Record
RHSA-2026:11696
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11698 8.6

Red Hat Security Advisory: ovn23.09 security update

Record
RHSA-2026:11698
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11700 8.6

Red Hat Security Advisory: ovn24.03 security update

Record
RHSA-2026:11700
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11701 8.6

Red Hat Security Advisory: ovn25.03 security update

Record
RHSA-2026:11701
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:11702 8.6

Red Hat Security Advisory: ovn25.09 security update

Record
RHSA-2026:11702
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:22110 8.6

Red Hat Security Advisory: ovn25.03 security update

Record
RHSA-2026:22110
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:22111 8.6

Red Hat Security Advisory: ovn25.09 security update

Record
RHSA-2026:22111
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5265 6.5

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

Record
UBUNTU-CVE-2026-5265
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10956-1 No score

libopenvswitch-3_7-0-3.7.1-34.1 on GA media

These are all security issues fixed in the libopenvswitch-3_7-0-3.7.1-34.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10956-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20972-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Changes for openvswitch:

  • Update ovn to 25.03.3
  • Bug fixes
  • Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
  • Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
  • Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
  • Update openvswitch to 3.5.4
  • Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
  • OVS validated with DPDK 24.11.4.
  • Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
  • Update openvswitch to 3.5.3
Record
openSUSE-SU-2026:20972-1
Updated
2026-11-02
OSVSUSE-SU-2026:22105-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
Record
SUSE-SU-2026:22105-1
Updated
2026-11-02
OSVSUSE-SU-2026:22145-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Changes for openvswitch:

  • Update ovn to 25.03.3
  • Bug fixes
  • Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
  • Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
  • Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
  • Update openvswitch to 3.5.4
  • Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
  • OVS validated with DPDK 24.11.4.
  • Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
  • Update openvswitch to 3.5.3
Record
SUSE-SU-2026:22145-1
Updated
2026-11-02
OSVSUSE-SU-2026:22152-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Changes for openvswitch:

  • Update ovn to 25.03.3
  • Bug fixes
  • Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
  • Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
  • Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
  • Update openvswitch to 3.5.4
  • Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
  • OVS validated with DPDK 24.11.4.
  • Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
  • Update openvswitch to 3.5.3
Record
SUSE-SU-2026:22152-1
Updated
2026-11-02
OSVSUSE-SU-2026:23188-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues:

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
Record
SUSE-SU-2026:23188-1
Updated
2026-11-02
OSVSUSE-SU-2026:2463-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

Update ovn to 25.03.3:

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
Record
SUSE-SU-2026:2463-1
Updated
2026-11-02
OSVSUSE-SU-2026:2475-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
Record
SUSE-SU-2026:2475-1
Updated
2026-11-02
OSVSUSE-SU-2026:2476-1 No score

Security update for openvswitch3

This update for openvswitch3 fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
Record
SUSE-SU-2026:2476-1
Updated
2026-11-02
OSVSUSE-SU-2026:2481-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
Record
SUSE-SU-2026:2481-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ovn
Debian:12
 All versions, plus listed versions
23.03.0-123.03.0-223.03.0-323.03.1-1~deb12u123.03.1-1~deb12u2
Show 29 moreShow less
23.09.0-123.09.0-224.03.0-124.03.0~git20240205.ebb7076-124.03.1-124.03.1-224.03.2-124.03.2-224.09.0-125.03.0-125.03.0~git20250216.7c69af7-125.03.0~git20250216.7c69af7-225.09.0-125.09.0-225.09.0-326.03.0-126.03.0-226.03.0-326.03.0-426.03.0-526.03.0-626.03.0~git20260216.b543a88-126.03.0~git20260216.b543a88-226.03.0~git20260216.b543a88-326.03.0~git20260216.b543a88-426.03.1-126.03.2-126.09.0-126.09.0~git20260819.c60a7af-1
 None known
ovn
Debian:13
 All versions, plus listed versions
25.03.0-125.09.0-125.09.0-225.09.0-326.03.0-1
Show 13 moreShow less
26.03.0-226.03.0-326.03.0-426.03.0-526.03.0-626.03.0~git20260216.b543a88-126.03.0~git20260216.b543a88-226.03.0~git20260216.b543a88-326.03.0~git20260216.b543a88-426.03.1-126.03.2-126.09.0-126.09.0~git20260819.c60a7af-1
 None known
ovn-2021
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-central
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-central-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-debugsource
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-host
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-host-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn-2021-vtep
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
Show 101 moreShow less
Affected packages
PackageAffectedFixed
ovn-2021-vtep-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:21.12.0-145.el8fdp
0:21.12.0-145.el8fdp
ovn23.06
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-central
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-central-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-debugsource
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-host
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-host-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-vtep
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06-vtep-debuginfo
Red Hat:enterprise_linux:8::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el8fdp
0:23.06.4-30.el8fdp
ovn23.06
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-central
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-central-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-debugsource
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-host
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-host-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-vtep
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.06-vtep-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.06.4-30.el9fdp
0:23.06.4-30.el9fdp
ovn23.09
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-central
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-central-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-debugsource
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-host
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-host-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-vtep
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn23.09-vtep-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:23.09.6-16.el9fdp
0:23.09.6-16.el9fdp
ovn24.03
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-central
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-central-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-debugsource
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-host
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-host-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-vtep
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn24.03-vtep-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:24.03.7-82.el9fdp
0:24.03.7-82.el9fdp
ovn25.03
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-central
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-central-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-debugsource
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-host
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-host-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-vtep
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.03-vtep-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el9fdp
0:25.03.2-100.el9fdp
ovn25.09
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-central
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-central-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-debugsource
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-host
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-host-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-vtep
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.09-vtep-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el9fdp
0:25.09.2-103.el9fdp
ovn25.03
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-central
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-central-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-debugsource
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-host
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-host-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-vtep
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.03-vtep-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.03.2-100.el10fdp
0:25.03.2-100.el10fdp
ovn25.09
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-central
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-central-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-debugsource
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-host
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-host-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-vtep
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
ovn25.09-vtep-debuginfo
Red Hat:enterprise_linux:10::fastdatapath
From an advisory covering 2 CVEs
 before 0:25.09.2-103.el10fdp
0:25.09.2-103.el10fdp
openvswitch
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 3.1.7-6.1
3.1.7-6.1
openvswitch
SUSE:Linux Micro 6.2
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1
openvswitch
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1
openvswitch
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1
openvswitch
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 3.1.7-slfo.1.1_4.1
3.1.7-slfo.1.1_4.1
openvswitch
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 2 CVEs
 before 3.5.4-150700.41.18.1
3.5.4-150700.41.18.1
openvswitch
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 2 CVEs
 before 3.5.4-150700.41.18.1
3.5.4-150700.41.18.1
openvswitch
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 3.1.7-150600.33.15.1
3.1.7-150600.33.15.1
openvswitch
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 3.1.7-150600.33.15.1
3.1.7-150600.33.15.1
openvswitch3
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 3.1.7-150500.3.31.1
3.1.7-150500.3.31.1
openvswitch3
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 3.1.7-150500.3.31.1
3.1.7-150500.3.31.1
openvswitch3
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 3.1.7-150500.3.31.1
3.1.7-150500.3.31.1
openvswitch3
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 3.1.7-150500.3.31.1
3.1.7-150500.3.31.1
openvswitch3
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 3.1.7-150500.3.31.1
3.1.7-150500.3.31.1
openvswitch
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 2.14.2-150400.24.35.1
2.14.2-150400.24.35.1
openvswitch
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.14.2-150400.24.35.1
2.14.2-150400.24.35.1
openvswitch
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.14.2-150400.24.35.1
2.14.2-150400.24.35.1
openvswitch
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 2.14.2-150400.24.35.1
2.14.2-150400.24.35.1
openvswitch
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 2.14.2-150400.24.35.1
2.14.2-150400.24.35.1
openvswitch
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 2.14.2-150400.24.35.1
2.14.2-150400.24.35.1
ovn
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.12.90~git20200107.c80e014d4-0ubuntu12.12.90~git20200107.c80e014d4-0ubuntu220.03.0~git20200212.9a4e68ec8-0ubuntu120.03.0~git20200212.9a4e68ec8-0ubuntu320.03.0-0ubuntu1
Show 9 moreShow less
20.03.1-0ubuntu120.03.1-0ubuntu1.120.03.1-0ubuntu1.220.03.2-0ubuntu0.20.04.120.03.2-0ubuntu0.20.04.220.03.2-0ubuntu0.20.04.320.03.2-0ubuntu0.20.04.420.03.2-0ubuntu0.20.04.520.03.2-0ubuntu0.20.04.6
 None known
ovn
Ubuntu:22.04:LTS
 All versions, plus listed versions
21.09.0~git20210922.6549e5842-0ubuntu121.09.0~git20210922.6549e5842-0ubuntu221.09.0-0ubuntu221.12.0-0ubuntu122.03.0~git20220218.ed81be7-0ubuntu1
Show 7 moreShow less
22.03.0-0ubuntu122.03.2-0ubuntu0.22.04.122.03.3-0ubuntu0.22.04.122.03.3-0ubuntu0.22.04.222.03.3-0ubuntu0.22.04.322.03.3-0ubuntu0.22.04.522.03.8-0ubuntu0.22.04.1
 None known
ovn
Ubuntu:24.04:LTS
 All versions, plus listed versions
23.09.0-123.09.0-224.03.0~git20240205.ebb7076-124.03.1-2ubuntu124.03.1-2ubuntu3
Show 4 moreShow less
24.03.2-0ubuntu0.24.04.124.03.2-0ubuntu0.24.04.224.03.6-0ubuntu0.24.04.124.03.8-0ubuntu0.24.04.1
 None known
ovn
Ubuntu:25.10
 All versions, plus listed versions
25.03.0-125.09.0~git20250813.23884f5-maysync125.09.0-1
 None known
ovn
Ubuntu:26.10
 All versions, plus listed versions
26.03.0-226.03.0-626.03.1-126.09.0~git20260819.c60a7af-126.09.0-1
 None known
ovn
Ubuntu:26.04:LTS
 All versions, plus listed versions
25.09.0-125.09.0-326.03.0~git20260216.b543a88-226.03.0-2
 None known
openvswitch
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.7.1-34.1
3.7.1-34.1
openvswitch
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5265 is a medium vulnerability (CVSS 6.5) in Red Hat Fast Datapath For Red Hat Enterprise Linux 10, published April 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. No source names a fixed version.

References

Show 73 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open