The flaw occurs in the Linux kernel's OVPN crypto routine. Crypto completion callbacks hold both a key‑slot reference and a peer reference. When the kernel releases the peer reference before those callbacks finish, the network device can be unregistered and the kernel module removed while a deferred RCU callback still holds references to module text. This ordering violation can execute a use‑after‑free, which results in a kernel crash. The race also frees the remaining socket buffer too early, widening the window for memory corruption and ultimately causing a kernel panic. The result is a denial of service that would propagate to all userspace on the affected host.

Any system running a Linux kernel that includes the OVPN module prior to the fix is affected. Because the impacted code is part of the default kernel source, any distribution whose kernel has not yet been updated to the corrected version is vulnerable; the explicit affected‑version list is not provided in the current data.

The CVSS score of 9.8 indicates critical severity. The EPSS score is less than 1%, implying that while exploitation is not widespread, it remains a viable attack vector for determined adversaries. Based on the description, it is inferred that the vulnerability could be exploited via code that triggers the OVPN crypto callback, potentially allowing an attacker to cause a use‑after‑free and crash the kernel. Successful exploitation results in a kernel panic, effectively causing a denial of service. The vulnerability is not listed in CISA’s KEV catalog, but given the severity, it should be considered high risk for systems that have not applied the fix.