In the Linux kernel, the OpenVPN TCP transport handling function ovpn_tcp_recv contains two critical bugs. The first bug causes a header offset overflow when pulling a large offset from a coalesced TCP buffer, which can corrupt internal header pointers and lead to dropped packets. The second bug extracts packets from arbitrary positions within the TCP stream without alignment guarantees, resulting in inefficient memory access and potential performance degradation. Together, these flaws can be triggered by specially crafted OpenVPN packets, causing repeated packet drops or resource exhaustion, and thus a denial‑of‑service attack surface.

All Linux kernel builds that support OpenVPN over TCP are affected, as the flaw exists in the kernel's generic packet processing path for this transport mode. Any system running an unpatched kernel that accepts OpenVPN TCP traffic may experience packet loss or degraded throughput; no specific version range is listed, so all prior releases before the patch are vulnerable.

No CVSS or EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog. The risk is primarily denial of service; the description does not indicate any memory corruption that would crash the kernel or provide code execution. An attacker could send crafted OpenVPN packets over TCP to trigger the header offset overflow or misaligned access, causing packet drops or CPU load, but an exploitation condition does not seem to require privileged or local access.