Out-of-bounds read in Linux kernel - CVE-2026-80735

Vulnerability details

The vulnerability allows a local user to read out-of-bounds memory.

The vulnerability exists due to an out-of-bounds read in the ovpn socket handling code when processing a socket whose sk_user_data is set without the expected encapsulation type. A local user can cause ovpn to dereference the socket's sk_user_data to read out-of-bounds memory.

Affected software

How to mitigate CVE-2026-80735

External References

• https://git.kernel.org/stable/c/43a31142e1d22b3cf5490bd94a94db7196901734
• https://git.kernel.org/stable/c/59aed1eb60d70678a53acccb0cb337a26ce6680e
• https://git.kernel.org/stable/c/61fb3cca40ff938671474f4a16adb908c19032d7

Related Security Bulletins

• Out-of-bounds read in Linux kernel net ovpn driver