A use-after-free flaw in the Linux kernel's Open vSwitch CT limit handling allows an unprivileged user to trigger memory corruption while a network namespace is being torn down. The flaw while packet processing still reads it, leading to a slab-use-after-free in the ovs_ct_execute() routine. This kernel memory corruption can enable arbitrary code execution at the kernel level, potentially providing a use-after-free defect tied to CWE-825.

All Linux kernel versions that include the Open vSwitch implementation are affected, regardless of distribution. The vulnerability exists in the kernel itself, making any system running a susceptible kernel variant potentially vulnerable.

The problem is a kernel flaw with moderate severity, as indicated by a CVSS score of 4.7. The exploit can be triggered by an unprivileged user within a network namespace, allowing a local user to launch the attack without elevated privileges. The EPSS score is < 1%, indicating a low probability of exploitation. KEV is not listed, so there is no known active exploitation. The attack requires the attacker to initiate a netlink request that causes the relevant network namespace to be torn down while packets are still being processed. The lack of a remote attack vector does not diminish the impact since local users can easily generate the required conditions.