CVE-2025-21958

A flaw was found in the Linux kernel's Open vSwitch (OVS) subsystem. When handling connection tracking entries created externally, the system improperly attempts to allocate label extensions on already confirmed connections. A local user could exploit this flaw during network flow processing, triggering kernel warnings and potentially causing a denial of service (DoS).

This vulnerability is rated as Low severity because triggering it requires local access and primarily results in non-fatal kernel warning messages rather than privilege escalation or memory corruption. Exposure is limited to environments where Open vSwitch processes connection tracking actions on pre-existing sessions, an operational model not enabled by default in standard deployments. Furthermore, stable enterprise releases including Red Hat Enterprise Linux 8 and 9 do not contain the upstream commit that introduced this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.