The vulnerability arises from the OVPN module in the Linux kernel queuing work items on global workqueues that run callbacks referencing module code. During module unload, the kernel does not wait for these callbacks to finish, allowing the module’s text to be freed while a worker is still executing code. This results in a use‑after‑free condition inside the kernel that could lead to arbitrary kernel code execution or system crash. The weakness is a classic use‑after‑free (CWE‑416).

All Linux kernel distributions that ship the OVPN module and have not applied the patch that moves OVPN work onto a module‑owned workqueue are affected. The advisory does not specify a kernel version range, so any system with the OVPN module loaded and dynamic module unloading enabled is potentially at risk. The issue affects only the kernel; user‑space applications are not directly impacted beyond their interaction with the kernel.

The EPSS score of < 1 % and the absence of a KEV listing suggest that the vulnerability is not widely exploited at present. The CVSS score of 8.4 indicates substantial potential impact if an attacker can trigger it. The likely attack vector is a local user with sufficient privileges to unload kernel modules or an attacker who can influence module load/unload events through compromised scripts or services. It is inferred that an attacker would need to force the module to be unloaded while workers are pending, which may require administrative rights, making this risk moderate to low in typical production environments but higher in systems that allow frequent or automated module unloads.