The vulnerability is a race condition in the OpenVPN TCP implementation within the Linux kernel that can lead to a NULL pointer dereference. When a peer is removed due to keepalive expiration while its socket is closed in userspace, the cleanup code attempts to access sk->sk_socket after it has been set to NULL by tcp_close(). This results in a kernel crash and causes a denial of service. The weakness is due to improper synchronization between kernel network stack operations and userspace socket lifecycle events.

Any Linux distribution that includes the Linux kernel before the fix identified by commit 94560267d6c41b1ff3fafbab726e3f8a55a6af34 (or the subsequent merge commit b9142cf4e066c825ec68752a7dcaceda700bbe26) is affected. Distributions running a kernel that still contains the earlier OpenVPN TCP code will be vulnerable. The issue does not affect userland OpenVPN binaries directly; it is a kernel-level race in the TCP subsystem.

Because the bug causes a kernel panic, the impact is a definite denial of service. The CVSS score is not publicly published, and EPSS data are unavailable, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits are known. An attacker would need to trigger the specific race condition by having a racer between the keepalive cleanup path and a userspace socket close—this may require privileged access to the OpenVPN process or a remote client that can force keepalive timeouts. While the attack complexity is moderate, the severe impact warrants prompt attention.