In the Linux kernel, unlock_ovpn() iterates over an OpenVPN peer release list and decrements a reference count within the loop. If the reference count reaches zero, the peer object may be freed while the iterator still attempts to read its next pointer. This results in a use‑after‑free condition in kernel space, allowing memory corruption of kernel objects during list traversal. The CVE description does not assert any further consequences such as privilege escalation or denial of service, only that the kernel memory is vulnerable.

All Linux kernel releases that do not include the commits referenced in the advisory are affected. The provided CNA information indicates the vulnerability exists in the core Linux kernel; specific affected versions are not enumerated, so any system running a kernel without the fixes identified by the commit URLs is at risk.

The CVSS score is 8.8 and the EPSS score is < 1%, indicating a high risk with a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, implying there are no publicly reported exploits. The likely attack vector requires local code execution that triggers unlock_ovpn(), which is inferred from the need to manipulate OpenVPN peer objects but is not explicitly stated in the CVE description.