CVE-2026-80735: ovpn: ensure socket is owned by ovpn before deref sk_user_data
In the Linux kernel, the following vulnerability has been resolved:
ovpn: ensure socket is owned by ovpn before deref skuserdata
Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype.
For this reason, we must make sure that the type is the one ovpn expects before dereferencing skuserdata.
Failing to do so may lead to out-of-bounds reads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the upstream kernel fix so ovpn ensures the socket is owned by ovpn before dereferencing sk_user_data.
Linux kernel (ovpn) Socket ownership check before dereferencing sk_user_data = owned_by_ovpn
Event History
Frequently Asked Questions
What conditions are required for the unsafe dereference to occur?
A socket must have sk_user_data set by another subsystem, such as BPF SOCKMAP, without the expected ovpn encapsulation type being set. The vulnerable ovpn path can then dereference that data despite it not being owned by ovpn.
What is the potential impact of this issue?
Failing to verify that the socket is owned by ovpn before dereferencing sk_user_data may lead to out-of-bounds reads.
Are systems using BPF SOCKMAP relevant to triage?
Yes. BPF SOCKMAP is specifically identified as a subsystem that can set sk_user_data without setting encap_type, creating the condition the fix is intended to handle.