The vulnerability occurs in the Linux kernel’s Open vSwitch implementation when a new meter is attached via attach_meter(). Should the attachment fail, the meter is freed while still visible to other CPUs, causing a use‑after‑free during ovs_meter_execute. This memory corruption can potentially lead to arbitrary kernel code execution if an attacker can influence the meter execution path, based on typical use‑after‑free effects.

The issue affects the Linux kernel, specifically the Open vSwitch module. No specific kernel versions are identified in the available data, so any kernel that incorporates the Open vSwitch module and has not yet applied the patch may be vulnerable.

The CVSS score of 7.8 indicates a high severity vulnerability, while the EPSS score of < 1% signals that exploitation is currently considered unlikely but not impossible. The vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that an attacker with privileged netlink access could trigger the UAF by issuing ovs_meter_cmd_set calls via the uAPI. The risk is that a hardened kernel may restrict such calls, yet any confidential or high‑privilege exploitation could result in kernel compromise.