A race condition in the Linux kernel’s OpenVPN TCP transport can cause ovpn_tcp_close() to dereference a socket peer pointer after that peer has been freed. The vulnerable code takes a reference to sock->peer under an RCU read lock, releases the lock, and later dereferences the same pointer once the RCU grace period has ended. If the peer socket is released concurrently, the pointer becomes dangling. Based on the description, it is inferred that the resulting use‑after‑free can corrupt kernel memory or crash the kernel, allowing an attacker who can influence the timing of a TCP socket close on an OVPN process to gain local code execution or privilege escalation.

Affected systems are Linux kernel implementations that include the patch that resolved the race. All kernel versions that embed the ovpn_tcp_close() path are potentially vulnerable until the kernel package3ef441907fca7c34… is installed. Version information is not explicitly listed in the CVE record, so any kernel run on a distribution that has not applied the fix is considered vulnerable.

The CVSS score of 8.4 indicates high severity. The EP< 1 % means the probability of exploitation observed in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a local or authenticated user or a compromised network client that can influence socket closure while the peer is shutting down. In the absence of a publicly available exploit, organizations should treat the vulnerability as high risk and deploy the fix promptly.