The vulnerability is a use‑after‑free (CWE‑825) caused by the Open VSwitch conntrack helper retaining a raw pointer to an extensions area that can be reallocated while a connection is still unconfirmed. If the helper is invoked before confirmation, subsequent reallocations leave the pointer dangling in the expectations list. Later removal of the expectation dereferences this stale pointer, corrupting kernel memory. An attacker who can influence the traffic processed by the conntrack helper could force the free and subsequently trigger the crash or gain control of kernel execution.

The flaw exists in all Linux kernels that contain the Open VSwitch conntrack code, as indicated by the CNA entry "Linux:Linux". Distribution kernels that ship the openvswitch kernel module are affected. No specific release, patch, or minor version is enumerated in the CNA data, so all kernels running the vulnerable code path at the time of the commit are potentially impacted. The vulnerability is not limited to a particular version or configuration, but it requires that the conntrack helper for Open VSwitch be enabled and that traffic flows through it.

The CVSS score of 9.8 places the flaw in the critical‑severity range, while the EPSS score of less than 1 % indicates that large‑scale exploitation has not yet been observed. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. Nevertheless, exploitation would require a network attacker to craft packets that trigger the conntrack helper before the connection is confirmed, a delivery channel that is typically available in many Open VSwitch deployments. Because the flaw leads to kernel memory corruption, a successful exploit could cause a system crash or allow arbitrary code execution at kernel privilege, which is unacceptable for any production system. The combination of high impact, kernel context, and potential for remote triggering makes this a high‑priority issue, even though the practical likelihood of exploitation remains low due to the timing and complexity of the required conditions.