The vulnerability resides in the Linux kernel Open vSwitch (OVS) code path that handles vport netlink replies. When an OVS user with the CAP_NET_ADMIN capability sets upcall PID arrays without bounds checking, a local attacker can supply an array large enough to overflow the fixed-size reply buffer. This triggers a BUG_ON during serialization, causing the kernel to panic and bring the system down. The flaw is an uncontrolled write to a fixed buffer, directly leading to a denial of service and potential loss of availability for all processes.

All Linux kernel builds that include Open vSwitch vport support and lack the upstream patch. This includes Ubuntu and other distributions that ship the default kernel with OVS enabled, especially when unprivileged user namespaces are active and the GENL_UNS_ADMIN_PERM permission can be leveraged. The exact kernel versions vary, but any kernel before the patch that processes large PID arrays via ovs_vport_set_upcall_portids() is affected.

The EPSS score is not available and the flaw is not listed in the CISA KEV catalogue, giving limited public awareness. The attack requires local privileges granted by CAP_NET_ADMIN or the ability to execute unshare -Urn in a namespace that gives access to the OVS configuration, which is a relatively narrow but potent local attack vector. Given the lack of publicly documented exploits and the nature of a kernel crash, the immediate risk is mitigated by the requirement of local privilege, but once the capability is present the impact is severe. The absence of a CVSS score makes precise severity assessment difficult, but the potential to bring a system down warrants high priority mitigation.