CVE-2026-80735ovpn: ensure socket is owned by ovpn before deref sk_user_data
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type. For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data. Failing to do so may lead to out-of-bounds reads.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f6226ae7a0cd47aaa9175aca6a1e19600f884cbf before 61fb3cca40ff938671474f4a16adb908c19032d7; from f6226ae7a0cd47aaa9175aca6a1e19600f884cbf before 43a31142e1d22b3cf5490bd94a94db7196901734; from f6226ae7a0cd47aaa9175aca6a1e19600f884cbf before 59aed1eb60d70678a53acccb0cb337a26ce6680e | CNA record |
References
- https://git.kernel.org/stable/c/61fb3cca40ff938671474f4a16adb908c19032d7
- https://git.kernel.org/stable/c/43a31142e1d22b3cf5490bd94a94db7196901734
- https://git.kernel.org/stable/c/59aed1eb60d70678a53acccb0cb337a26ce6680e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.