A use‑after‑free flaw exists in the Linux kernel’s openvpn packet handling code. When a socket buffer is shared, the system prematurely frees its memory yet continues to operate on the stale pointer during subsequent processing steps, such as peer lookup and destination resolution. This kernel‑level memory corruption can allow an attacker to manipulate a victim’s kernel memory or cause arbitrary code execution if the attacker can supply crafted VPN traffic.

All Linux kernel builds that lack the patch introduced in commit 3e4fbcb4e078915367ba5576cd70d76dbc970f95. The vulnerability is present across distributions that ship unpatched kernel versions; affected vendors include all Linux kernel maintainers. Precise impacted versions are not enumerated in the advisory, but any kernel before the fix may be susceptible.

No CVSS score or EPSS data are currently available, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the memory‑corruption nature of the flaw suggests a high impact if exploited. Attackers are likely to target systems that accept untrusted OpenVPN traffic; the attack can be executed remotely by sending malicious packets or locally via privileged operations. The lack of publicly available exploitation reports indicates that exploitation may still be in the research phase, but the potential for severe compromise warrants prompt remediation.