The bug resides in the Open vSwitch (OVS) teardown path inside the Linux kernel. During port removal, the code clears the IFF_OVS_DATAPATH flag before completing unregistration. If a preemption event occurs on a PREEMPT_RT kernel, the netdev_destroy callback can run while the device flag is already cleared, and the device is freed before unregistration finishes. This acquires a use‑after‑free condition that triggers a general protection fault and a kernel panic. The result is a loss of system stability and an immediate denial of service. The weakness is a classic race condition (CWE‑362).

All Linux kernel releases that include the original OVS teardown logic before the fix referenced in the advisory URLs are affected. The vulnerability applies to both standard and PREEMPT_RT kernels. No exact kernel version list is supplied, so any kernel build older than the specific commit that introduced the fix is considered vulnerable.

The CVSS score of 7.8 indicates a high severity vulnerability that can crash the kernel. The EPSS score of <1% and the absence of a KEV listing suggest that while exploitation is possible, it is not yet widespread. An attacker only needs local or low‑privilege access to send requests to the OVS interface or to trigger port tear‑downs to create the required race condition. The mismatch between scheduling states on PREEMPT_RT kernels makes the race easier, but the vulnerability is still exploitable on standard kernels that allow concurrent access to the teardown routine.