A use-after-free vulnerability in the Linux kernel Open vSwitch module, identified as CVE-2026-80994, poses a significant risk for local privilege escalation and system instability.

This flaw exists in the Open vSwitch flow management logic, where a race condition occurs during the deletion of a flow mask. Because the mask pointer is accessed after being freed via RCU, a local attacker with low privileges can trigger a use-after-free condition, leading to kernel-level memory corruption.

Successful exploitation of this vulnerability allows an attacker with local access to trigger a kernel crash, resulting in a denial of service. Furthermore, memory corruption in the kernel can often be leveraged to achieve local privilege escalation, granting the attacker full control over the affected system. With a CVSS score of 7.8, this vulnerability represents a high-severity risk to infrastructure integrity and data confidentiality.

Immediate Action: Administrators should update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by their distribution vendor.

Proactive Monitoring: Security teams should monitor system logs for Kernel Panic events or KASAN error reports, which may indicate that this vulnerability is being triggered.

Compensating Controls: If immediate patching is not feasible, restrict local access to the system and minimize the usage of Open vSwitch modules on untrusted environments to reduce the attack surface.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, organizations should prioritize the deployment of the provided kernel patches across all affected environments. Testing the update in a staging environment is advised to ensure compatibility with existing Open vSwitch configurations, followed by an accelerated rollout to production systems to mitigate the risk of local exploitation.