Executive brief
A vulnerability was identified in the Linux kernel's OpenVPN (ovpn) module when handling TCP network traffic. The issue involves how the system processes large streams of data, which can lead to internal errors and dropped network packets. If exploited, this could allow a remote attacker to disrupt VPN services, leading to a denial-of-service condition for users relying on the encrypted connection.
Technical details
The vulnerability exists in the ovpn_tcp_recv function within the Linux kernel's OpenVPN implementation. When processing coalesced TCP streams, the use of pskb_pull with large offsets can cause the header offset to exceed the 16-bit storage capacity of skb->network_header, leading to an integer overflow. This results in a failure of skb_reset_network_header and subsequent packet drops. Additionally, the implementation suffered from unaligned protocol headers due to OpenVPN's 2-byte length prefix. The fix involves allocating a new socket buffer (skb) for each packet and using skb_copy_bits to ensure proper alignment and prevent offset overflows. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.16 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-05-06: advisory: CVE-2026-43254 published by kernel.org
- 2026-03-04: patched: Fix committed to stable kernel trees