Description

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type. For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data. Failing to do so may lead to out-of-bounds reads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T13:06:12.343Z",
  "pubdate": "2026-09-03T13:06:12.343Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) read flaw within the Linux kernel's OpenVPN (ovpn) subsystem.\nThe issue originates from an improper validation of the 'sk_user_data' pointer within a socket's structure, which is accessed without verifying that the socket's encapsulation type matches the expectations of the ovpn module.\nAn attacker capable of influencing or interacting with socket configurations could potentially trigger this dereference.\nThe primary impact involves an out-of-bounds memory read, which may lead to kernel memory disclosure or system instability, potentially resulting in a kernel panic.\nThis vulnerability affects the ovpn subsystem and poses a risk to system integrity and confidentiality by exposing kernel-space data that should remain encapsulated.\nSuccessful exploitation requires the ability to leverage subsystems like BPF SOCKMAP, which can modify 'sk_user_data' without setting the required 'encap_type', thereby bypassing expected structural constraints.",
  "technicalDetails": "The vulnerability resides in how the ovpn subsystem handles kernel socket structures, specifically when performing operations that assume the integrity and ownership of 'sk_user_data'.\nIn the Linux networking stack, 'sk_user_data' is a generic pointer used by various subsystems to store auxiliary information associated with a socket. The ovpn module assumes that if it is managing a socket, 'sk_user_data' contains a specific structure relevant to OpenVPN operation.\nThe root cause is a failure in the validation logic: the ovpn code dereferences 'sk_user_data' based on the assumption that the socket is exclusively owned or configured for ovpn, without checking the underlying 'encap_type' field.\nThe vulnerability is triggered because other kernel subsystems, most notably BPF SOCKMAP, may manipulate 'sk_user_data' for their own internal tracking purposes, such as redirecting traffic or managing socket maps, without modifying the socket's 'encap_type'.\nWhen the ovpn subsystem subsequently interacts with such a socket, it erroneously treats the foreign data pointed to by 'sk_user_data' as if it were a valid ovpn object. This leads to an out-of-bounds memory access where the kernel attempts to interpret arbitrary or unrelated memory addresses as ovpn-specific structures.\nExploitation flow: 1. An attacker identifies a socket being utilized by both the ovpn subsystem and an interfering subsystem like BPF SOCKMAP. 2. The attacker triggers a state change where BPF SOCKMAP populates 'sk_user_data'. 3. The attacker invokes an ovpn function that attempts to dereference 'sk_user_data'. 4. Because the 'encap_type' remains unchecked, the kernel proceeds to process the malicious or foreign data as an ovpn pointer. 5. This results in the kernel reading beyond the intended memory boundaries, potentially leaking sensitive kernel heap data back to user-space or triggering a crash due to an invalid address dereference (null pointer or non-canonical address).\nThis vulnerability does not require authentication to the OpenVPN tunnel itself, as the flaw is inherent in the socket management layer of the kernel driver. It highlights a breakdown in subsystem isolation when multiple kernel modules interact with the same 'sock' structure."
}