The flaw occurs in the Linux kernel's OVPN crypto routine. Crypto completion callbacks hold both a key‑slot reference and a peer reference. When the kernel releases the peer reference before those callbacks finish, the network device can be unregistered and the kernel module removed while a deferred RCU callback still holds references to module text. This ordering violation can execute a use‑after‑free, which is commonly known as CWE‑416. The race also frees the remaining socket buffer too early, further widening the window for memory corruption and ultimately causing a kernel crash. The result is a denial of service that would propagate to all userspace on the affected host.

Any system running a Linux kernel that includes the OVPN module prior to the fix applies to this vulnerability. Because the impacted code is part of the default kernel source, any distribution whose kernel has not yet been updated to the corrected version is affected; the explicit affected‑version list is not provided in the current data.

The vulnerability is a classic use‑after‑free that requires code execution within the kernel or the ability to trigger the OVPN crypto callback. The available data does not supply a CVSS or EPSS score, and the vulnerability is not listed in CISA's KEV catalog. The most likely attack vector is local privilege escalation or exploitation by a kernel module that can initiate the vulnerable callback path. Successful exploitation would result in a kernel panic, effectively taking the host offline. The lack of publicly known exploitation at present and the absence of sentinel data suggests that current risk is moderate but it should be treated as severe if the kernel is unpatched.