In the Linux kernel, the ovpn subsystem fails to confirm that a socket is owned by ovpn before dereferencing the sk_user_data pointer. The code allows other subsystems, such as BPF SOCKMAP, to set sk_user_data without setting the accompanying encapsulation type. When this condition occurs, the kernel may read memory beyond the intended bounds, resulting in an out‑of‑bounds read.

All Linux kernel releases that contain the vulnerable ovpn code path and that have not yet integrated the ownership‑check commit. This includes every current kernel distribution and any older kernels that remain unpatched. Once the patch is applied, the vulnerability is eliminated for that kernel version.

The CVSS score of 7.3 indicates high severity, while the EPSS score of <1% suggests a low but nonzero exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with either local or remote access to BPF programs or kernel socket handling could manipulate sk_user_data to trigger the unchecked read, potentially exposing kernel memory or causing a kernel fault.