Executive brief
A vulnerability in the Linux kernel's OpenVPN (ovpn) module could allow a local attacker to cause a system hang. This occurs due to a synchronization issue when a new VPN peer is added at the same time the network interface is being deleted. If triggered, the system may become unstable or fail to properly shut down network services, potentially leading to a denial of service.
Technical details
A race condition exists in the ovpn module of the Linux kernel between the interface deletion routine (ovpn_dellink) and the addition of a new peer via netlink (CMD_PEER_NEW). When an interface is being removed, a concurrent request to add a peer can acquire a reference to the netdevice after the deletion process has already attempted to free all peers. This prevents the netdevice from being fully unregistered, leading to a kernel hang. The fix involves moving peer release logic to ndo_uninit() and implementing a registration state check in ovpn_peer_add() while holding the netdev_lock.
Affected products
- Linux Linux 6.16 to 6.18.33, 7.0.0 to 7.0.10
Timeline
- 2026-07-19: advisory: CVE-2026-64043 published by kernel.org