The Linux kernel OpenvSwitch conntrack subsystem can perform a use‑after‑free when an unconfirmed connection‑tracking entry is cloned. A first clone commits extensions and then loses its confirmation, leaving the entry unconfirmed. A second clone later commits a different set of extensions, modifying the shared expectation list pointer and corrupting it. If this corrupted entry is later destroyed, the kernel dereferences freed memory, leading to a kernel panic or potential privilege escalation. The flaw is limited to OpenvSwitch’s conntrack stack but resides in the core kernel, so any process able to trigger the clone path can exploit it.

Any Linux kernel that includes the OpenvSwitch conntrack module before the patch that resets shared unconfirmed entries. Distributions that ship such kernels are affected until they apply an updated kernel containing the fix.

The CVSS score is 7.8 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, requiring injection of crafted networking packets that cause the conflicting clone sequence. Because the flaw can cause a kernel crash or code execution, the potential impact includes service disruption and privilege escalation, especially on systems without additional mitigations such as SELinux or grsecurity. Attackers would need network access to the vulnerable interfaces, so limiting exposure reduces risk but does not eliminate it until the kernel is patched.