The vulnerability in the Linux kernel's ovpn subsystem involved a race condition in ovpn_nl_peer_set_doit() where a peer was looked up before acquiring a lock. Concurrent operations such as peer deletion or socket teardown could remove the peer from hash tables before the lock was acquired, but the code would then rehash the removed peer, effectively resurrecting it in the hash tables. This led to a use-after-free window when the peer was freed but hash entries remained linked. The fix adds a check under lock to bail out of rehashing if the peer's hash entry has already been unhashed, preventing resurrection and UAF.

The vulnerability could cause use-after-free conditions in the kernel's ovpn peer management, potentially leading to memory corruption or instability. Userspace would believe the peer was removed, but it could still be reachable internally, causing inconsistent state and possible security risks. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by adding a check to skip rehashing peers already removed from hash tables. Users should update to a kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the exact fixed versions and patch availability.