The vulnerability in the Linux kernel's openvswitch vport subsystem arises from a self-deadlock condition during the release of tunnel ports. Vports are concurrently used and protected by RCU, requiring netdev_put() to be called after the RCU grace period, either in an RCU callback or after synchronize_net(). However, rtnl_delete_link() must execute under RTNL lock and cannot run in RCU context. The existing code called synchronize_net() while holding RTNL, which is suboptimal, so the fix was to call netdev_put() in an RCU callback. The deadlock occurs because the RCU callback was scheduled after rtnl_unlock(), but rtnl_unlock() calls netdev_run_todo() and blocks until all references are released, which never happens as the RCU callback is not yet executed. The fix moves the rcu_call() before rtnl_unlock(), ensuring the callback runs timely and prevents the deadlock. This vulnerability affects Linux kernel versions prior to 7.0.0-28.28 and related builds as listed. The issue is resolved in updated kernel packages provided by Ubuntu.

This vulnerability causes a denial of service condition by creating a self-deadlock during the removal of tunnel ports in the Open vSwitch vport subsystem. It does not affect confidentiality or integrity but can block device removal operations, potentially impacting system stability and availability. No known exploits are reported in the wild.

A patch is available and should be applied by updating to the fixed Linux kernel versions as provided by the vendor. After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully to ensure full remediation.