A race condition in the Linux kernel’s openvswitch module can cause a confirmed conntrack entry to be reallocated while still being accessed by another CPU. The unsafe reallocation frees memory that is in use, corrupting kernel memory and potentially crashing the kernel. The flaw is a concurrency bug that can lead to a denial of service. The vulnerability arises from improper handling of labels extensions for confirmed conntrack entries.

The issue exists in the openvswitch driver bundled with the Linux kernel. Any distribution whose kernel contains the unpatched openvswitch implementation is affected, regardless of vendor. No explicit version range is listed; kernels released before the commit that added the safe handling logic are vulnerable. Systems that run openvswitch or create conntrack entries with labels on a vulnerable kernel are at risk.

The CVSS score of 7.8 indicates a high severity impact. The EPSS score is listed as <1%, implying a very low probability of exploitation. The flaw is not in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The likely attack vector is local or privileged; an attacker would need to influence network traffic that interacts with the kernel’s conntrack subsystem to trigger the race condition. Although the timing race makes successful exploitation difficult, a successful exploit would result in a kernel crash and loss of availability.