Executive brief
The Linux kernel's OpenVPN implementation contains a use-after-free vulnerability in peer management that allows attackers to access or manipulate network peers that have already been deleted. This flaw could enable unauthorized network traffic interception, session hijacking, or denial of service on systems using OpenVPN.
Technical details
The vulnerability is a use-after-free in the OpenVPN peer rehashing logic triggered by a race condition. When ovpn_nl_peer_set_doit() or ovpn_peer_endpoints_update() hold only a refcount before acquiring ovpn->lock, a concurrent peer deletion (via OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown) can remove the peer from hash tables. The set_doit or endpoints_update functions then re-insert the removed peer into hash tables via ovpn_peer_hash_vpn_ip(), resurrecting it as reachable through RX and TX lookups. Once the data-path refcount drops, the peer is freed while hash entries remain linked, creating a UAF window. The fix checks if hash_entry_id is unhashed before performing rehash operations, bailing out if the peer was already removed.
Affected products
- Linux Linux kernel unfixed versions prior to patch
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched