The Linux kernel’s openvswitch component includes a function validate_set() that mistakenly treats the OVS_KEY_ATTR_MPLS attribute as a variable‑sized payload for SET and SET_MASKED operations. OVS, however, expects a fixed‑size struct representing an MPLS key. Because the kernel fails to reject mismatched payload lengths, an attacker can supply an incorrectly sized MPLS action, potentially causing memory corruption within the kernel and resulting in a crash. The described weakness is a type 1284 error—out‑of‑bounds access that can lead to denial of service.

All Linux kernel builds that incorporate the openvswitch stack are potentially impacted. The advisory lists kernel CPEs for versions 7.0 rc1 through rc5, indicating that any running kernel containing the vulnerable openvswitch code path should be considered at risk until the patch is applied.

The CVSS score of 7.1 classifies this vulnerability as high severity. The EPSS score of less than 1% suggests a low likelihood of current exploitation. It is not present in the CISA KEV catalog. Based on the nature of the bug, the likely attack vector would involve delivering a maliciously crafted MPLS packet to a target system that has openvswitch enabled. This inference is drawn from the fact that validate_set() is invoked during MPLS action handling, but the advisory does not explicitly confirm the exact exploitation method.