The CVE identifies an error path in the OpenVPN kernel module where the function ovpn_nl_peer_new_doit() directly calls ovpn_peer_release() instead of ovpn_peer_put(), bypassing the kernel reference counter. This allows the peer object to be destroyed while another user of the socket still holds a reference to it, resulting in use‑after‑free. When the freed peer memory is later accessed, the kernel can experience memory corruption, potentially enabling privilege escalation. The weakness is classified as CWE‑825, a resource leak through missing release of a resource.

The vulnerability resides in the Linux kernel’s OpenVPN module and affects any kernel version that incorporates that module until the correction is applied. No specific version range is listed in the CVE data, so all kernels that have shipped unpatched OpenVPN code are considered potentially vulnerable.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% suggests exploitation is unlikely at this time, and the vulnerability is not listed in CISA's KEV catalog. The flaw requires that an attacker trigger the creation of a new VPN peer while a local user has an open socket that references the same peer. The likely attack surface is local to the OpenVPN daemon, although a remote attacker could influence the condition if they control the OpenVPN server. Because the vulnerability involves kernel memory corruption, successful exploitation could lead to privilege escalation or denial of service. The probability of exploitation is low, but the potential impact remains high if the flaw is triggered.