A race condition exists in the Linux kernel’s openvswitch networking module where the flow table mask array is reallocated before the old array is fully released. The old array remains reachable between the call to call_rcu() and the pointer swap, allowing a reader in ovs_flow_tbl_lookup_stats() to access freed memory. This use‑after‑free can lead to kernel memory corruption, which may cause the system to crash or, if exploited, grant an attacker arbitrary code execution in kernel mode.

The vulnerability affects all Linux kernel releases that include the openvswitch module and have not applied the upstream patch. Systems running Open vSwitch with the kernel module are at risk until the kernel is updated to the fixed version.

The CVSS score of 7.8 indicates high severity. The EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not cataloged in CISA KEV. Attackers are likely to trigger the race window by manipulating traffic directed to Open vSwitch, such as sending crafted packets or flows while the reallocation occurs; this inference is drawn from the described timing window and interaction with packet processing. The potential for remote code execution exists if the kernel memory corruption is successfully exploited.