What is the CVSS score of EUVD-2026-70339?

EUVD-2026-70339 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-70339?

The Linux kernel's in-kernel OpenVPN driver contains an out-of-bounds memory read vulnerability affecting versions 6.16 and later, enabling local attackers to leak kernel memory and potentially…. A patch is available.

How to fix or mitigate EUVD-2026-70339?

Within 24 hours, identify and inventory all systems running Linux kernel versions 6.16 through affected pre-patch stable releases, particularly those running OpenVPN or dependent services. Within 7 days, apply the available vendor-released patch from your Linux distribution to all affected systems. Within 30 days, verify patch deployment across your infrastructure and implement kernel-level monitoring to detect exploitation attempts targeting memory access patterns.

Linux Kernel EUVD-2026-70339

| CVE-2026-80735 HIGH

2026-09-03 Linux

GHSA-2h35-47m3-h9hp

Linux Suse

7.3

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

5.3 MEDIUM

OOB read only, no write confirmed, so I:N; concurrent SOCKMAP+ovpn on same socket is a specific non-default condition, raising AC:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

5.1 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Metadata Corrected

Sep 04, 2026 - 05:40 vuln.today

tag: Buffer Overflow removed

Analysis Generated

Sep 04, 2026 - 05:25 vuln.today

CVSS changed

Sep 04, 2026 - 05:22 NVD

7.3 (HIGH)

Patch available

Sep 03, 2026 - 10:16 EUVD

CVE Published

Sep 03, 2026 - 08:21 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 03, 2026 - 08:21 cve.org

HIGH 7.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ovpn: ensure socket is owned by ovpn before deref sk_user_data

Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type.

For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data.

Failing to do so may lead to out-of-bounds reads.

AnalysisAI

Out-of-bounds kernel memory reads in the Linux kernel's ovpn (in-kernel OpenVPN) driver allow a local attacker with low privileges to leak kernel memory by abusing a missing ownership check on the sk_user_data socket field. The driver dereferences sk_user_data as an ovpn-internal structure without first confirming that encap_type identifies the socket as ovpn-owned, so when BPF SOCKMAP or another subsystem has populated sk_user_data with a different pointer type, ovpn misinterprets that memory and reads out of bounds. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation is limited to systems running Linux kernel 6.16 or later with the ovpn kernel module loaded and in active use. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-supplied CVSS 7.3 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) rates this as high severity, but the I:H metric is not supported by the description, which explicitly states the consequence is out-of-bounds reads - a read-only primitive does not directly confer integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to a patched Linux stable kernel: 6.18.45, 7.1.9, or 7.2, containing the respective fix commits available at git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all systems running Linux kernel versions 6.16 through affected pre-patch stable releases, particularly those running OpenVPN or dependent services. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-70339 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-70339

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code