An out-of-bounds read vulnerability in the Linux kernel OVPN subsystem could allow a local authenticated attacker to compromise system integrity and confidentiality.

The flaw exists because the OVPN subsystem fails to verify the encapsulation type before dereferencing the sk_user_data field, which can be manipulated by other subsystems such as BPF SOCKMAP. An attacker with local low-level privileges can trigger this condition to achieve out-of-bounds memory access.

Successful exploitation allows an attacker to read sensitive kernel memory, which may lead to the compromise of system secrets or the bypass of security protections. Given the CVSS score of 7.3, this represents a significant risk to system stability and data security. While the attack requires local access, the potential for kernel-level memory corruption makes this a high-priority concern for environments running containerized or multi-tenant workloads.

Immediate Action: Update the Linux kernel to version 6.18.45, 7.1.9, or a later stable release where this issue has been addressed.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports that may indicate exploitation attempts targeting memory-related subsystems.

Compensating Controls: Restrict access to BPF-related system calls for non-privileged users, as these interfaces are often leveraged in conjunction with kernel memory vulnerabilities to elevate privileges.

Public Exploit Available: Unknown

This vulnerability presents a high risk to Linux-based infrastructures due to the potential for kernel memory corruption. Administrators must prioritize updating affected kernels to the recommended versions to eliminate the underlying logic error in the OVPN socket handling. Failure to patch may expose the kernel to unauthorized memory access by locally authenticated users.