Linux Kernel EUVD-2026-103731

Requires a host running the Linux kernel Open vSwitch (openvswitch) module with a conntrack datapath where packets carrying an unconfirmed ct entry get cloned and then committed more than once into the SAME conntrack zone with differing extension sets (e.g. one clone wiring up helper/expectation extensions and another adding a labels extension). Limiting factors: the attack vector is local (AV:L) and needs low privileges per the input vector (PR:L), so authentication/local access is required; it is not remotely reachable against a default configuration, and the maintainer explicitly states there is no practical/normal network pipeline that commits both clones unmodified into the same zone - making the required configuration non-default and unusual, which substantially narrows realistic exploitation to hosts with Open vSwitch conntrack in use.

Signals point to a genuine but low-urgency memory-safety bug, not a drop-everything emergency. The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8) reflects a local, low-privilege use-after-free in the Open vSwitch conntrack path with high impact to the host kernel. Exploitation signals, however, are weak: EPSS is 0.21% (11th percentile), the CVE is NOT on CISA KEV (no confirmed active exploitation), and no PoC or exploit reference appears in the input - so the status is no public exploit identified at time of analysis. The vendor priority label is 'this_week', consistent with a locally-exploitable kernel UAF that warrants scheduled patching rather than emergency response. One important caveat: the vendor rates AC:L, but the maintainer's own description says the condition requires an skb with a shared unconfirmed ct entry being committed twice into the same zone with different extension sets, and explicitly notes 'there should be no practical network pipeline where committing both clones without modifications into the same zone is needed' - i.e. the trigger is an unusual, essentially non-production configuration, which argues the real-world attack complexity is higher than AC:L suggests. Net: a real local DoS/privilege-escalation candidate on hosts actually running OVS conntrack, but low probability of opportunistic exploitation.

A local attacker (or a container/tenant able to drive traffic through a host's Open vSwitch datapath configured with conntrack commit actions) crafts packets that are cloned and committed into the same conntrack zone twice, so the second commit adds a label extension that breaks the expectation-list pointer set up by the first. The dangling pointer causes a use-after-free on the conntrack destruction path, which can crash the kernel or potentially be leveraged for code execution. No public exploit code was identified in the provided data, and the required double-commit-into-same-zone pipeline is not a normal production configuration.