A use‑after‑free flaw exists in the Linux kernel’s OpenVPN packet handling code. When ovpn_net_xmit builds a socket‑buffer list, skb_share_check may free a shared buffer while the code continues to use the stale pointer for peer lookup, destination dropping, and statistics updates. The resulting kernel memory corruption can lead to kernel‑level compromise; while the official description does not detail a specific exploitation method, it is inferred that an attacker could potentially trigger this corruption by crafting malformed OpenVPN packets.

All Linux kernel builds that do not contain the patch introduced in commit 3e4fbcb4e078915367ba5576cd70d76dbc970f95 are affected. Any distribution running an unpatched kernel with the OpenVPN module is potentially vulnerable whenever it accepts OpenVPN traffic over the kernel networking stack.

The CVSS score of 7.8 indicates high severity, but the EPSS score is below 1 % and the vulnerability is not in CISA’s KEV catalog, suggesting limited public exploitation. The possibility of exploitation via crafted OpenVPN packets is inferred from the code behavior; no confirmed public exploits exist. Timely remediation is advised to prevent possible kernel‑level compromise.