The vulnerability resides in the Linux kernel Open vSwitch (OVS) code path that handles vport netlink replies. When an OVS user with the CAP_NET_ADMIN capability sets upcall PID arrays without bounds checking, a local attacker can supply an array large enough to overflow the fixed-size reply buffer. This triggers a BUG_ON during serialization, causing the kernel to panic and bring the system down. The flaw is an uncontrolled write to a fixed buffer, directly leading to a denial of service and potential loss of availability for all processes.

All Linux kernel builds that include Open vSwitch vport support and lack the upstream patch. This includes Ubuntu and other distributions that ship the default kernel with OVS enabled, especially when unprivileged user namespaces are active and the GENL_UNS_ADMIN_PERM permission can be leveraged. The exact kernel versions vary, but any kernel before the patch that processes large PID arrays via ovs_vport_set_upcall_portids() is affected.

The EPSS score of 0.00018, less than 1%, indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalogue, meaning public awareness is limited. Attack requires local privileges with CAP_NET_ADMIN or ability to run unshare -Urn to reach the OVS configuration; this is a narrow local attack vector. Although no publicly documented exploits exist, the kernel crash can bring the system down, making the impact severe if the capability is available. The CVSS score of 7.0 remains high, underscoring the need for timely patching.