The vulnerability is a race condition in the Linux kernel's OpenVPN TCP implementation that leads to a NULL pointer dereference. When an OpenVPN peer is removed for keep‑alive expiration while its TCP socket has been closed by the operating system, the cleanup code dereferences sk->sk_socket after it has been set to NULL, which crashes the kernel. This results in a denial of service by triggering a kernel panic. The CVSS score of 5.5 and the EPSS score of less than 1% indicate a low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Exploitation would involve creating a race between the cleanup routine and a socket close; this may require manipulating the OpenVPN process or influencing keep‑alive timing.

Any Linux distribution that includes the Linux kernel before the fix identified by commit 94560267d6c41b1ff3fafbab726e3f8a55a6af34 (or the subsequent merge commit b9142cf4e066c825ec68752a7dcaceda700bbe26) is affected. Distributions running a kernel that still contains the earlier OpenVPN TCP code will be vulnerable. The issue does not affect user‑land OpenVPN binaries directly; it is a kernel‑level race in the TCP subsystem.

The vulnerability can trigger a kernel crash, inducing a denial of service. With a CVSS score of 5.5, an EPSS score below 1%, and no listing in the CISA KEV catalog, the likelihood of exploitation is low. Exploitation requires coordinating a race between the keep‑alive cleanup path and a userspace socket close, necessitating control over the OpenVPN process or manipulating its keep‑alive timing.