Linux Kernel EUVD-2026-66585

Requires the ovpn (in-kernel OpenVPN data-channel-offload) module to be built and in use - systems without ovpn are unaffected. The race is reached via peer release (last peer reference drop) during active crypto callbacks, or via the TX error path, or during module unload/netdev unregistration; the module-removal path additionally needs CAP_SYS_MODULE (root). Limiting factors: high attack complexity (a narrow RCU/async-callback timing window that must be won), local access to drive ovpn peer state, and applicability only to recent kernels shipping the ovpn driver. This is not remotely reachable against a default configuration despite the input's AV:N rating.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is inconsistent with the described mechanism and should be treated as an automated over-rating. The actual defect is a race between async crypto callbacks and peer/netdev/module teardown - triggering it requires local interaction with an ovpn interface and, for the module-removal window, CAP_SYS_MODULE (root). Attack complexity is high (a narrow RCU timing window), so 'AC:L/PR:N' does not hold. No EPSS score, KEV entry, or POC was provided; there is no public exploit identified at time of analysis. This is a correctness/robustness fix with primarily availability (kernel crash/UAF) impact, not a widely-exploitable network RCE. The 'Information Disclosure' tag in the input conflicts with the description, which points to a teardown memory-corruption/crash rather than a read primitive - verify with the upstream commits before treating leakage as confirmed. Net: low real-world priority relative to the 9.8 label; patch during normal kernel maintenance.

A local user or process able to bring ovpn peers up and down (or an administrator unloading the ovpn module) triggers rapid peer disconnects while crypto completions are in flight, winning the RCU timing window so a callback fires against freed peer/module memory. The result is kernel memory corruption-typically a crash (DoS), with theoretical escalation potential inherent to a use-after-free. No POC is provided and the high attack complexity makes reliable exploitation difficult.