Open vSwitch records a truncation delta in a packet buffer control block. When a userspace action later splits a GSO packet, the same delta is applied to each fragment, allowing the truncation value to exceed the actual fragment length. This underflows the size passed to a zero‑copy routine, potentially corrupting kernel memory or causing a crash. The flaw revolves around improper numeric validation and can compromise confidentiality, integrity, or availability of the host.

The flaw exists in the Linux kernel’s Open vSwitch implementation. All Linux systems running a kernel that contains the openvswitch code module are affected, regardless of specific distribution version, until the fix commit is in place.

No CVSS score is published and the EPSS score is not available, so the numeric likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Because the flaw involves a high‑privilege kernel routine, a successful exploit could lead to kernel memory corruption or a crash, potentially enabling privilege escalation. The likely attack vector is a malicious OVS userspace process that can dictate segment actions for packets traversing the switch. Exploitation would require the attacker to influence OVS packet handling, which is normally restricted to trusted components.