static int tun_release(struct socket *sock)
{
	if (sock->sk)
		sock_put(sock->sk);
	return 0;
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.