The Linux kernel's Open vSwitch stores generated flow actions as netlink attributes with a 16-bit length field (nla_len). A prior commit removed a length check that prevented nested action attributes from exceeding the maximum 16-bit length, allowing oversized nested containers with truncated length fields. This discrepancy causes later processing to interpret the action stream differently than originally validated, particularly with nested CLONE/CT actions, potentially leading to memory misinterpretation or corruption. The patch restores validation by rejecting oversized nested containers and ensures proper resource release during recursive action construction failures.

This vulnerability allows an attacker with local privileges to craft malformed nested action attributes that bypass length validation, causing the kernel to process structurally different data streams. This can lead to memory corruption or unintended behavior affecting confidentiality, integrity, and availability of the system. The CVSS score of 7.8 reflects high impact with local attack vector and low complexity but requiring privileges.

A fix has been implemented in the Linux kernel to reject oversized nested action attributes in Open vSwitch and to properly release resources on failure. Users should apply the official kernel updates containing this patch. Since no patch links are provided here, check the Linux kernel vendor advisories or trusted sources for the updated kernel versions containing this fix. No alternative mitigations are indicated.