In the Open vSwitch implementation within the Linux kernel, the allocation of a reply socket buffer can occur before or after acquiring the ovs_mutex lock. If the buffer allocation fails after the lock has been taken, the variable is set to an ERR_PTR value. Cleanup code, however, assumes the pointer was allocated and attempts to free it after unlocking, leading to an invalid free and possible corruption of kernel memory. This flaw is a classic Use After Free vulnerability (CWE‑416) and could trigger a corruption, or provide an escalation path for privileged attackers.

The flaw affects the Linux kernel’s Open vSwitch module. No specific kernel version range is provided, so all kernels that include the unpatched Open vSwitch code are potentially vulnerable. The vendor identifiers list only “Linux:Linux” and the CPE reflects the generic Linux kernel.

The CVSS score is not disclosed, and the EPSS score is unavailable, but the nature of the bug—an improper free in kernel space—implies a high degree of risk for denial of service and potential privilege escalation. The bug is not currently listed in CISA’s KEV catalog. Because the code path requires privileged access to the Open vSwitch module and a failure in packet allocation, exploitation is non‑trivial but conceivable in a suitable environment.