In the Linux kernel’s OpenVPN (ovpn) implementation, the function that removes cryptographic keys assumes that both crypto slots are populated and dereferences each slot before verifying it is non‑NULL. If a peer has only one installed key and a removal request targets a missing key, the function dereferences a null pointer. Based on the description, this null dereference is likely to cause a kernel crash, resulting in a denial of service. This conclusion is inferred from the stated dereference behavior, as the description does not explicitly confirm a crash. Nonetheless, the severity of a kernel crash aligns with a denial of service impact.

Any system running a Linux kernel that includes the unpatched OpenVPN module is affected. The specific kernel versions are not enumerated in the input; however, any kernel containing the ovpn_crypto_kill_key logic before the patch commits referenced (41d44ac7a61e2f74453af40d4fe1b82af9ea0ada, a47a080d06ee9d94dc6a2da0fc2b9beeeedb92b3, or acf32a5dff082044cf0fd9492f3c10b7357c15ee) is at risk. The affected product is the Linux kernel as a whole, with the OpenVPN module as the vulnerable component.

The CVSS score is not publicly available, but the vulnerability’s potential to crash the kernel indicates a high‑severity impact. The EPSS score is not provided, and the issue is not listed in CISA’s KEV catalog, suggesting that documented exploitation is limited. Based on the description, the exploit path is inferred to be a remote attack through the OpenVPN control interface, where a malicious peer can trigger the key removal routine to cause a kernel panic.