CVE-2024-1151

What it actually does

The flaw allows unbounded recursive calls within the Open vSwitch kernel module without stack-depth validation, resulting in kernel stack overflow that can crash the system or trigger other undefined behavior.

Why it matters to the business

Linux hosts running Open vSwitch may experience sudden kernel crashes and reboots, interrupting network virtualization, container networking, and any dependent services until the system is recovered.

How an attack unfolds

A local attacker supplies crafted input or configuration that drives the OVS datapath into repeated recursive code paths; because the module never checks remaining stack space, the call stack grows until it overflows, causing a kernel panic.

How to fix it

Apply the Linux kernel update that adds explicit stack-depth validation inside the Open vSwitch sub-component; until a fixed kernel is available, restrict untrusted local access to systems using OVS.

How to confirm the fix worked

Confirm the running kernel contains the stack-depth check for OVS; reproduce the recursive operation in a test environment and verify the system no longer panics.

Typical attack path

1. Obtain a local shell or user account on the target Linux system
2. Trigger OVS module operations that invoke recursive code paths
3. Force excessive frame pushes leading to stack exhaustion and crash

How to detect it

Review kernel logs and dmesg output for Open vSwitch stack-overflow or recursion-related panics; correlate with any recent local process activity involving OVS netlink or datapath operations.

• openvswitch: recursion depth exceeded
• kernel BUG at net/openvswitch/
• stack overflow in ovs_

What your security team should do

• Prioritize kernel updates on all systems that load the openvswitch module
• Reduce attack surface by limiting local user access on production hosts
• Include OVS stack-overflow crash signatures in kernel monitoring rules