The vulnerability in the Linux kernel's openvswitch module involves a use-after-free condition during connection tracking (CT) limit teardown. Packet processing accesses CT limit state protected by RCU, but the network namespace teardown frees this state under ovs_mutex without removing the pointer from readers or waiting for an RCU grace period. This allows packet processing to dereference freed memory, leading to a slab-use-after-free in ovs_ct_execute(). An unprivileged user can exploit this from user and network namespaces. The fix includes publishing the CT limit pointer via RCU, removing it before teardown, waiting for readers to finish, and maintaining proper locking with ovs_mutex and RCU read-side locks during updates and traversals. The netns teardown detaches the CT limit state in the pernet .pre_exit callback while holding ovs_mutex, relying on the pernet core's RCU grace period guarantees to complete teardown safely.

An unprivileged user with access to user and network namespaces can trigger a use-after-free condition in the openvswitch connection tracking code during network namespace teardown. This can cause a slab-use-after-free in kernel memory, potentially leading to kernel crashes or undefined behavior. No known exploits in the wild have been reported. The vulnerability affects kernel stability and security by allowing unsafe memory access in kernel space.

A fix has been implemented in the Linux kernel openvswitch component that properly synchronizes CT limit pointer access using RCU and ovs_mutex, removes the pointer before teardown, and waits for readers before freeing memory. Users should apply the official kernel update that includes this fix. Since this is a kernel vulnerability, upgrading to the patched kernel version is the recommended remediation. No additional mitigation steps are indicated or required beyond applying the official fix.