CVE-2026-80735

The Linux kernel's ovpn (OpenVPN data path offload) module dereferences a socket's sk_user_data pointer without first verifying that the socket is actually owned by ovpn. Other kernel subsystems, notably BPF sockmap, also populate sk_user_data without setting the encap_type that ovpn expects, so a local user who arranges for such a socket to be processed by ovpn can trigger an out-of-bounds read. Per the CVSS vector (local attack, low privileges required, high confidentiality and integrity impact), this could expose sensitive kernel memory and potentially affect integrity, though the advisory only confirms the out-of-bounds read. Only systems running kernels with the ovpn module, where the same sockets are also used by other sk_user_data consumers such as BPF sockmap, are affected; specific affected version ranges were not provided in the advisory data. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known (EPSS roughly 0.1%).

What to do: Install a patched kernel from your distribution or vendor as soon as it is published, since the advisory does not name a fixed version; check your distro's security tracker for the backported ovpn fix. As an interim mitigation, avoid running ovpn interfaces alongside BPF sockmap or other sk_user_data consumers on the same sockets, and limit untrusted local access on systems that use ovpn. Given no known PoC or in-the-wild exploitation (EPSS about 0.1%), handling this within your normal patch cadence is reasonable.