The ovpn cryptographic subsystem in the Linux kernel freed key slots through an RCU callback that could perform a sleep operation, such as when an asynchronous or hardware AES‑GCM implementation completes teardown. That was unsafe because RCU callbacks must run without sleeping; violating that contract could trigger a kernel panic or OOPS. The upstream fix moves the AEAD transform freeing to a workqueue, enabling sleeping in the teardown path while preserving the necessary RCU grace period for concurrent readers.

Any Linux kernel build that includes the ovpn module and its key‑slot handling logic is at risk. The version information is not specified in the advisory, so all kernels that have not incorporated the upstream patch for the "ovpn: defer key slot crypto freeing to workqueue" update are potentially vulnerable until the change is applied.

The CVSS score of 7.5 indicates high severity, yet the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low expected exploitation rate. Exploitation would likely require a local or privileged attacker who can cause the ovpn module to release a key slot—such as loading/unloading the module or manipulating crypto usage. Because the flaw operates in kernel space, an attacker who achieves kernel execution could force a crash, leading to a denial of service. While no public exploits exist yet, the combination of high severity and the kernel impact makes defensive action prudent.