Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems,… (CVE-2026-80735)

The vulnerability in the Linux kernel ovpn subsystem arises because sk_user_data is dereferenced without verifying that the socket is owned by ovpn and that the encap_type matches the expected value. Certain subsystems such as BPF SOCKMAP set sk_user_data without setting encap_type, which can cause out-of-bounds memory reads. The fix ensures that the socket ownership and encap_type are validated before dereferencing sk_user_data, preventing this unsafe memory access.

Successful exploitation could lead to out-of-bounds reads in kernel memory, potentially exposing sensitive information or causing system instability. The CVSS score of 7.3 reflects high impact on confidentiality and integrity, with some impact on availability.

A fix has been implemented in the Linux kernel to ensure proper validation of socket ownership and encap_type before dereferencing sk_user_data in the ovpn subsystem. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.