The Linux kernel’s ovpn module allows an attacker to trigger a race condition: while learning a local endpoint, the code updates the bind structure without acquiring the necessary lock. During UDP transmission, this field can be read concurrently, resulting in a torn address read. Such an insecure read may cause the kernel to dispatch packets using an incorrect address or may lead to a kernel panic, resulting in a denial of service. The weakness is a classic data‑race.

The flaw exists in the Linux kernel’s ovpn module and affects all kernel revisions that have not incorporated the patch that replaces direct bind assignments with a safe publish mechanism. Systems running older Linux distributions or custom kernels that have not applied this update are vulnerable.

No CVSS score is published, and the EPSS score is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Inferred that an attacker would need to send crafted network traffic that triggers concurrent local endpoint learning and UDP transmission, demanding precise timing. Other than the inferred attack conditions, the impact could culminate in a kernel panic or incorrect address dispatch, leading to denial of service. Because the exploit conditions are not fully documented and no publicly available exploits exist, the risk remains moderate but requires proactive mitigation.