Linux Kernel Cached Destination Counter Decrement Vulnerability in dst_release

A vulnerability exists in the Linux kernel related to the handling of cached destination (dst) counters in the networking subsystem. When the CONFIG_DST_CACHE option is enabled and Open vSwitch (OvS) with tunnels is used, the kernel can encounter a paging request error due to improperly managed dst_cache entries. The issue arises because the fix for a previous vulnerability moved the decrementing of dst counts to the dst_release function, but did not fully address the problem for cached dsts, leading to access violations on already freed data.

Impact

Exploitation of this vulnerability causes a kernel paging request error, indicating a failure to properly manage memory access, which can lead to system instability or crashes.