Executive brief
A vulnerability was identified in the Linux kernel's OpenVPN (ovpn) module. When setting up a new connection peer over TCP, an error in how the system tracks active users could lead to a system crash or memory corruption. This occurs because the system might delete connection data while it is still being accessed by other parts of the software. This could impact the stability and availability of systems using the kernel-based OpenVPN implementation.
Technical details
A use-after-free vulnerability exists in the ovpn module of the Linux kernel. In the ovpn_nl_peer_new_doit() function, the error path incorrectly calls ovpn_peer_release() directly instead of ovpn_peer_put(). While this is safe for UDP (where peers are not yet reachable), for TCP, the peer is already published via rcu_assign_sk_user_data() during socket attachment. If an error occurs while a userspace thread (such as ovpn_tcp_recvmsg) is blocked and holding a reference to the peer, the direct release destroys the object prematurely. Subsequent attempts to drop the reference by the blocked thread result in operations on freed memory. The fix replaces the direct destructor call with a reference-counted put operation.
Affected products
- Linux Linux Kernel Affected versions include those implementing ovpn TCP transport (introduced in 11851cbd60ea) prior to the fix.
Timeline
- 2026-05-13: other: Patch authored
- 2026-07-19: disclosed: CVE published