Loading story…
Red Hat disclosed two heap over-read vulnerabilities in OVN (Open Virtual Network) that can leak memory from ovn-controller back to attacker-controlled workloads. CVE-2026-5367 affects DHCPv6 Client ID processing: when the userspace pinctrl thread builds a DHCPv6 ADVERTISE reply, it echoes a Client ID option using an attacker-supplied length field without checking packet bounds. A malicious workload can send a crafted DHCPv6 SOLICIT packet with an inflated Client ID length and cause heap data beyond the valid packet buffer to be copied into the reply and returned to the VM port, particularly in deployments where DHCPv6 options are configured on Logical Switch Ports.
A second flaw, CVE-2026-5265, affects ICMP error generation in the same component. OVN copies packet data into ICMP Destination Unreachable or Packet Too Big responses based on self-declared IPv4 or IPv6 length fields without validating them against the actual buffer size, allowing a malicious VM to send truncated packets with inflated length values and receive adjacent heap memory in the ICMP reply. The issue can be triggered through reject ACLs, Gateway MTU checks, or reject-configured load balancers. Users were advised to apply patches or upgrade to fixed releases including v24.03.8, v25.03.3, v25.09.3, and v26.03.1; for CVE-2026-5367, v24.09.4 is also listed as fixed, while Red Hat noted the previously referenced 24.09 release for CVE-2026-5265 will not occur.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat disclosed CVE-2026-5265, a heap over-read in OVN's ICMP error response generation caused by trusting self-declared IPv4 or IPv6 length fields without validating packet bounds. A malicious VM can trigger ICMP errors via reject ACLs, Gateway MTU checks, or reject-configured load balancers and receive leaked heap memory in the response.
Red Hat published an advisory for CVE-2026-5367, describing a heap over-read in OVN's DHCPv6 Client ID processing. A malicious workload can send a crafted DHCPv6 SOLICIT packet with an inflated Client ID length and receive leaked heap memory in the DHCPv6 reply.
Patches were made available for affected OVN versions, with fixed releases including v24.03.8, v24.09.4, v25.03.3, v25.09.3, and v26.03.1 for CVE-2026-5367, and v24.03.8, v25.03.3, v25.09.3, and v26.03.1 for CVE-2026-5265. Red Hat advised users to upgrade rather than rely on mitigations that could disrupt traffic.
MITRE assigned CVE-2026-5367 to the OVN heap over-read vulnerability affecting DHCPv6 ADVERTISE reply generation in ovn-controller. The issue impacts deployments using DHCPv6 options on Logical Switch Ports.
The OVN team credited Seiji Sakurai with reporting a heap over-read flaw in DHCPv6 Client ID processing that was later assigned CVE-2026-5367. The bug allows attacker-controlled length fields in crafted DHCPv6 SOLICIT packets to cause memory beyond valid packet data to be copied into replies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026
OpenWrt released **24.10.8** and corresponding **25.12.5** updates to fix a critical remote code execution flaw in `odhcpd`, tracked as **CVE-2026-53921**, that could let an unauthenticated attacker send a crafted DHCPv6 `REQUEST` to UDP port `547` and potentially execute code as **root** on affected routers. The project said the service release addresses numerous security issues, including several **remotely triggerable flaws in default-enabled network services**, and strongly recommended that users upgrade. OpenWrt also updated its 24.10 stable release pages to identify **24.10.8** as the latest release in the series. Beyond the DHCPv6 bug, the release includes fixes across the **Linux kernel**, `dnsmasq`, `uhttpd`, `rpcd`, `cgi-io`, LuCI components, `umdns`, `ead`, `hostapd`/`wpa_supplicant`, `dropbear`, `musl libc`, and **OpenSSL**. Reported issues addressed include three HTTP request-smuggling bugs in `uhttpd`, a DHCPv6 hostname-injection flaw leading to stored XSS in LuCI, and a path traversal issue in `cgi-io` tracked as **CVE-2026-62947**; OpenWrt noted that optional package fixes require separate package updates. The project also said the **24.10** branch is now in **security-maintenance mode** with end of life projected for September 2026, and advised users to migrate to **OpenWrt 25.12** before then.
Jul 29, 2026