HIGH Introduced in 6.16
ovpn Socket OOB
CVE-2026-80735
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type. For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data. Failing to do so may lead to out-of-bounds reads.
02KernelScan AI Analysis
Risk summary
A local attacker with low privileges can trigger an out-of-bounds read in the ovpn kernel module by causing sk_user_data to be set by another subsystem (like BPF SOCKMAP) without setting the expected encap type, then having ovpn dereference it as an ovpn_socket. This can lead to information disclosure or kernel memory corruption.
Vulnerability analysis
The ovpn network module assumes that every socket it handles was previously set up by itself. However, other kernel subsystems—such as the BPF socket-map facility—can attach their own data to a socket without using the ownership markers that ovpn expects. When the module later processes such a socket, it misinterprets the foreign data as one of its own internal objects, causing an out-of-bounds read of kernel memory. The fix adds a guard that verifies a socket truly belongs to ovpn before interpreting the attached data, blocking the invalid access. A local attacker who can configure BPF maps and create network sockets can reach this code path by attaching an affected socket to an ovpn interface.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.45 | 61fb3cca40ff |
| 7.1 | 6.16 | 7.1.9 | 43a31142e1d2 |
| mainline | 6.16 | 7.2 | 59aed1eb60d7 |