CVE-2026-80735

ovpn: ensure socket is owned by ovpn before deref sk_user_data

State: Published
Severity: 7.3 High
Published: Sep 3, 2026
Updated: Sep 4, 2026
Reserved: Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ovpn: ensure socket is owned by ovpn before deref sk_user_data

Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type.

For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data.

Failing to do so may lead to out-of-bounds reads.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f6226ae7a0cd47aaa9175aca6a1e19600f884cbf to before 61fb3cca40ff938671474f4a16adb908c19032d7Affected f6226ae7a0cd47aaa9175aca6a1e19600f884cbf to before 43a31142e1d22b3cf5490bd94a94db7196901734Affected f6226ae7a0cd47aaa9175aca6a1e19600f884cbf to before 59aed1eb60d70678a53acccb0cb337a26ce6680eAffected
LinuxLinux	6.16Affected before 6.16Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.