The Linux kernel’s ovpn cryptographic module released key slots via an RCU callback that could sleep. Because the teardown path could block, the original implementation was unsafe for hardware or asynchronous crypto backends and could cause kernel panics or OOPS events. The patch defers freeing of the AEAD transforms to a workqueue, which permits sleep and preserves the RCU grace period needed for concurrent readers.

The flaw affects any Linux kernel build that includes the ovpn module and its key‑slot handling logic, regardless of the specific kernel version, until the deferred teardown patch is applied. The lack of explicit versioning means all affected kernels using the ovpn subsystem are at risk until they incorporate the change from the upstream fix.

The CVSS score of 7.5 indicates high severity, while the EPSS score is not available. The issue is not listed in CISA’s KEV catalog, so formal severity data are missing in that context. Exploitation would likely require a local or privileged user who can trigger the ovpn module to release a key slot, such as by loading or unloading the module or manipulating crypto usage. Because the vulnerability involves kernel execution paths, it could be leveraged by an attacker with the ability to execute code in kernel mode to cause a denial of service. The lack of publicly available exploits does not eliminate the risk, and the threat remains significant until the patch is deployed.