The vulnerability in the Linux kernel's Open vSwitch push_nsh() action arises from inadequate validation of the middle nested attribute within the OVS_ACTION_ATTR_PUSH_NSH structure. While the outermost and innermost attributes are validated, the middle attribute is not verified to be the expected OVS_KEY_ATTR_NSH or properly sized. This leads to unsafe double unwrapping of nested attributes, potentially causing invalid memory access and slab-out-of-bounds errors during action execution, as detected by Kernel Address Sanitizer (KASAN). The fix involves adding checks to ensure the attribute is properly sized and is the only attribute inside the action, preventing such memory safety violations.

Exploitation of this vulnerability can cause invalid memory access resulting in kernel crashes or denial of service due to out-of-bounds reads in the Open vSwitch kernel module. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, impacting confidentiality and availability with high severity. There is no indication of information disclosure or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly validate the middle attribute in the push_nsh() action of Open vSwitch. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. Patch status is not explicitly provided here; users should consult the Linux kernel vendor advisory or distribution security updates for the official fixed versions.