Linux Kernel CVE-2026-53227

The vulnerability resides in the Linux kernel's net/openvswitch subsystem (CPE: cpe:2.3:o:linux:linux_kernel). Open vSwitch is a multilayer virtual switch integrated into the kernel, widely used in SDN, virtualization, and cloud environments. A prior refactor changed the ordering of reply skb (socket buffer) allocation relative to ovs_mutex acquisition, but the error-path cleanup code retained the original assumption that 'reply' is always allocated before the lock is taken and freed after it is released. When allocation fails post-lock, the 'reply' pointer holds an ERR_PTR sentinel value rather than NULL. The subsequent cleanup stage calls kfree_skb() on this invalid pointer, which is undefined behavior in the kernel and typically causes an immediate panic. The root cause class is CWE-401 (Missing Release of Memory after Effective Lifetime), specifically a pointer-state management error introduced by an ordering change in a prior patch (fixing commit 893f139b9a6c00c097b9082a90f3041cfb3a0d20).