The Linux kernel contains a flaw in the OVPN UDP socket cleanup path where an unrelated peer replacement can be released when a socket is destroyed. The kernel mistakenly drops a reference to the new peer, freeing the object while it is still in use. This results in a slab‑use‑after‑free that KASAN reports and can be exploited to corrupt memory or achieve arbitrary code execution, potentially escalating privileges on the affected system.

The vulnerability is present in the Linux kernel as a whole. No specific version range is listed, indicating the issue could exist in any kernel prior to the patch that rewrites the mismatch branch. Administrators should assume that any kernel that has not yet incorporated the fix is affected.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score is less than 1%, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation would require an attacker to influence the OVPN peer replacement process while a UDP socket is being torn down, suggesting a local or partially privileged attack vector. The risk is therefore significant for systems running vulnerable kernel versions.