In the Linux kernel's Open vSwitch implementation, a missing length validation allows a crafted nested action attribute to exceed the 16‑bit nla_len field, causing the kernel to accept a truncated container. When the stream is subsequently parsed, the kernel interprets the following bytes as separate actions, which can result in out‑of‑bounds reads or writes in kernel memory, potentially crashing the system or providing an attacker with a foothold to gain higher privileges, especially when OVS processes privileged flow entries.

All Linux kernels that include Open vSwitch and have not applied the fix for this issue. No specific kernel version numbers are listed, so any system using a kernel with OVS prior to the patch is potentially impacted.

The CVSS base score is 7.8, indicating a high severity, and the EPSS score is below 1 percent, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker capable of directing malformed OVS flow actions to the kernel, such as by sending crafted packets to an OVS instance or influencing a local user with sufficient access to OVS configuration. The available fix rejects oversized nested containers and returns an error, effectively preventing the out‑of‑bounds scenario once applied.