Local privilege escalation via unprotected vport dereference

Use-after-free in the Open vSwitch kernel datapath in Linux allows local users to gain elevated privileges through local access. ovs_vport_cmd_fill_info dereferences a vport-associated network namespace without holding RTNL or an RCU read-side lock, allowing concurrent teardown to free the referenced object. A local low-privilege account and access to the Open vSwitch datapath are required; successful exploitation compromises kernel memory and can interrupt the system.