The Linux kernel code that handles ovpn sockets does not verify that a socket is really owned by the ovpn subsystem before dereferencing the sk_user_data field. Some subsystems, such as BPF SOCKMAP, set the sk_user_data pointer without correctly setting the encapsulation type, which can lead the kernel to read memory beyond the intended bounds. This results in an out‑of‑bounds read that may expose sensitive kernel memory to an attacker, or, in the worst case, trigger a kernel crash.

All Linux kernel deployments that include the vulnerable ovpn code path and have not applied the commit that adds the ownership check are affected. This includes every current base kernel release until the patch is incorporated, as well as older kernels that remain unpatched.

The CVSS score is not publicly published and the EPSS score is not available; it is not listed in the CISA KEV catalog. The vulnerability can be leveraged from code that can influence BPF programs or kernel socket handling, giving an attacker a local or potentially remote kernel‑level vector depending on BPF access controls. The out‑of‑bounds read can leak kernel memory, so the impact is high, though the lack of an EPSS or KEV status leaves the exploitation probability unclear.