The vulnerability in the Linux kernel's Open vSwitch implementation involves a use-after-free condition on the flow mask pointer during flow deletion. Specifically, the flow mask is scheduled for freeing via RCU immediately after removal from the flow table, but the pointer remains accessible in the flow structure within the same RCU critical section. During CMD_DEL processing, the code does not take the RCU read lock before removal, yet subsequently accesses the flow->mask pointer, leading to a race condition. If the RCU grace period passes between removal and information filling, a use-after-free occurs, causing kernel crashes as detected by KASAN. The fix changes the order of operations to call ovs_flow_tbl_remove() after ovs_flow_cmd_fill_info(), eliminating the race and removing a cosmetic RCU read lock.

This vulnerability can lead to kernel crashes due to use-after-free memory access in the Open vSwitch flow deletion path. While the race window is short, it can cause real system instability or denial of service if triggered. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel source to reorder function calls and remove the race condition. Users should update to a kernel version that includes this fix. Since this is a kernel vulnerability, applying the official patch or upgrading to a fixed kernel release is the recommended remediation. No alternative mitigations or workarounds are described.