The vulnerability was discovered in the Linux kernel's OVPN module handling deferred work. OVPN queues work items that execute module code on global system workqueues, but module exit does not guarantee that these callbacks have completed before the module's text is freed. Object references protect used resources but do not ensure the work queue functions have returned. Consequently, a worker could drop the final reference that releases device teardown while still executing OVPN code, leading to a use‑after‑free condition that could be exploited by an attacker to execute arbitrary code at kernel level. The weakness is a use‑after‑free error (CWE‑416).

All Linux kernel distributions that include the OVPN module before the fix are affected. No specific kernel version range is provided, but any installation that loads the OVPN module and has not applied the patch that moves OVPN work onto a module‑owned workqueue is at risk. The vulnerability applies to the Linux kernel itself, not a specific vendor product beyond the open‑source kernel.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that no publicly known exploit is in use. However, a use‑after‑free in the kernel could allow local privilege escalation or denial of service if an attacker can trigger module unload while work items are pending. The risk depends on the ability to unload the OVPN module during normal operation, which is unlikely in a typical system but possible in a configuration with dynamic module loading or a scheduled restart. The CVSS score is not provided, so the exact severity cannot be quantified from the available data, but the nature of the flaw indicates a high potential impact upon exploitation.