The Linux kernel’s Open vSwitch code contains a flaw in which the netdev_put reference for a tunnel device is removed after the device has already been unregistered. This race condition can cause a use‑after‑free, allowing an attacker to corrupt kernel memory. If exploited, the corruption could lead to a kernel panic or provide a foothold for arbitrary kernel code execution. The weakness is classified as CWE‑367.

Any Linux kernel that includes the Open vSwitch module before the fix is applied is affected. The advisory does not list version ranges, so all kernels containing the vulnerable destroy path are susceptible until the patch is deployed.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1 % shows a low probability of exploitation and there are no known public exploits or KEV inclusion. Based on the description, it is inferred that an attacker would need local or privileged rights to trigger the Open vSwitch tunnel teardown, and because the flaw is a race condition, the outcome is non‑deterministic. Nonetheless, the potential for kernel restarts or privilege escalation warrants prompt action.