A critical memory underflow vulnerability in the Linux kernel Open vSwitch module could allow an unauthenticated attacker to cause system crashes or potentially execute arbitrary code.

This vulnerability is caused by an integer underflow in the Open vSwitch (OVS) module when processing Generic Segmentation Offload (GSO) packets. An unauthenticated attacker can trigger this flaw by manipulating OVS actions, leading to memory corruption during packet handling.

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it allows for full system compromise without requiring user interaction or authentication. Successful exploitation can lead to a complete denial of service through system crashes, or potentially remote code execution, which poses a severe risk to data confidentiality, integrity, and availability within network infrastructure.

Immediate Action: Update the Linux kernel to the versions specified in the OSV fixed packages list (5.10.265, 5.15.216, 6.1.183, 6.6.148, or later).

Proactive Monitoring: Monitor system logs for kernel panic events or repeated OVS module failures that may indicate an exploitation attempt.

Compensating Controls: Implement network segmentation and restrict access to Open vSwitch management interfaces to reduce the attack surface.

Public Exploit Available: Unknown

Given the critical nature of this kernel vulnerability and its potential for remote exploitation, organizations using Open vSwitch should prioritize patching their kernel versions immediately. Failure to apply the provided fixes leaves critical infrastructure susceptible to system-wide compromises. Update your kernel packages through your distribution's stable security channels as soon as the updates become available.