Executive brief
A vulnerability in the Linux kernel's OpenVPN (ovpn) module could allow a local user to cause a system crash. The issue occurs when the system attempts to clean up a VPN connection at the same time a user closes the associated network socket. This race condition leads to a 'null pointer dereference,' which typically results in a Blue Screen of Death or a kernel panic, impacting the availability of the server or workstation.
Technical details
A race condition exists in the Linux kernel's ovpn module within the TCP socket detachment logic. When a peer is removed (e.g., due to keepalive expiration), it is placed in a release list for processing by ovpn_tcp_socket_detach(). If userspace concurrently closes the associated TCP socket, tcp_close() invokes sock_orphan(), which sets sk->sk_socket to NULL. When the ovpn release routine resumes, it attempts to dereference sk->sk_socket to restore original socket operations, leading to a kernel crash. The fix involves accessing sk->sk_socket atomically under the sk_callback_lock.
Affected products
- Linux Linux Kernel Introduced in 11851cbd60ea (ovpn: implement TCP transport)
Timeline
- 2026-02-12: patched: Initial patch authored by Antonio Quartulli
- 2026-05-27: disclosed: CVE published