A race condition in the Linux kernel’s OpenVPN (OVPN) module allows an attacker to remove a peer and then, before the module fully releases its lock, re‑insert that same peer into internal hash tables. The rehashed peer becomes reachable again while the original data‑structure is still marked for deletion, opening a use‑after‑free window. The vulnerability is sufficient to corrupt kernel memory and could lead to kernel crashes or arbitrary code execution. The precise impact, however, is inferred from the UAF nature of the flaw; it is not explicitly stated in the advisory that privilege escalation or code execution has been demonstrated.

All Linux kernel builds that contain the OVPN module are affected. No specific kernel version list is provided, so any kernel that has the unpatched rehash code should treat this as a potential local kernel security issue.

The CVSS score of 9.8 signals critical severity. The EPSS score of <1% indicates a very low probability of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with local or privileged access who can manipulate OVPN peers via the netlink interface, creating the race condition. Because the flaw couples a deletion and rehashing operation that are not properly synchronized, it is inferred that an attacker could exploit the resulting UAF to achieve kernel‑level code execution.