The Linux kernel exposes a bug in the OpenVPN TCP transport handler when it receives a TCP stream that contains multiple coalesced OpenVPN packets. The handler copies packet data from arbitrary offsets inside the stream, which can cause an integer overflow on the skb network header length and dereference a corrupted pointer, leading to dropped packets. Additionally, because the packet length prefix and subsequent headers are misaligned, the copy operation can trigger expensive unaligned memory accesses, further degrading performance. Together, these flaws can result in significant packet loss and throughput reduction for unsuspecting OpenVPN clients and servers.

All Linux kernel versions that include the OpenVPN TCP transport code are affected, since the flaw resides in a generic part of the kernel’s networking stack. Any system running an unpatched kernel that accepts OpenVPN traffic over TCP may experience packet loss or degraded throughput. No specific version ranges are listed, implying that all releases prior to the commit that introduced the fixed logic remain vulnerable.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of < 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could trigger the bug by sending specially crafted OpenVPN packets over TCP, possibly from a remote source, causing repeated packet drops or excessive CPU usage. The exploitation does not require local or privileged access and does not lead to code execution, instead offering a denial‑of‑service surface.