{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64044","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.029Z","datePublished":"2026-07-19T15:39:29.869Z","dateUpdated":"2026-07-20T13:42:44.713Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-07-20T13:42:44.713Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: respect peer refcount in CMD_NEW_PEER error path\n\novpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly\nrather than ovpn_peer_put(), bypassing the kref. The accompanying\ncomment (\"peer was not yet hashed, thus it is not used in any context\")\nholds for UDP but not for TCP.\n\nFor UDP, the ovpn_socket union uses the .ovpn arm and never points back\nat a peer; UDP encap_recv looks up peers via the not-yet-populated\nhashtables, so the new peer is unreachable until ovpn_peer_add()\npublishes it.\n\nFor TCP, ovpn_socket_new() sets ovpn_sock->peer and\novpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data().\nFrom that moment until ovpn_socket_release() detaches in the error path,\nthe TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll\non the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can\nreach the peer through sk_user_data -> ovpn_sock->peer and bump its\nrefcount via ovpn_peer_hold().\n\novpn_tcp_socket_wait_finish() (called inside ovpn_socket_release())\ndrains strparser and the tx work, but does not synchronize with\nuserspace syscall callers that already hold a peer reference. If\novpn_nl_peer_modify() or ovpn_peer_add() returns an error while such\na caller is in flight - notably an ovpn_tcp_recvmsg() blocked in\n__skb_recv_datagram() on peer->tcp.user_queue - the direct\novpn_peer_release() destroys the peer while the caller still holds\nthe reference, and the eventual ovpn_peer_put() from that caller\noperates on freed memory.\n\nReplace the direct destructor call with ovpn_peer_put() so the kref\ncorrectly defers destruction until the last reference is dropped.\nIn the common case where no concurrent user is present, behaviour is\nunchanged: the kref hits zero immediately and ovpn_peer_release_kref()\nruns the same destructor.\n\nWith this conversion ovpn_peer_release() has no callers outside peer.c\n- ovpn_peer_release_kref() in the same translation unit is the only\nremaining user - so make it static and drop its declaration from\npeer.h."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ovpn/netlink.c","drivers/net/ovpn/peer.c","drivers/net/ovpn/peer.h"],"versions":[{"version":"11851cbd60ea1e5abbd97619d69845ead99303d6","lessThan":"8298834912d76dbc82c12b6b4ab7590ed2bb8ae5","status":"affected","versionType":"git"},{"version":"11851cbd60ea1e5abbd97619d69845ead99303d6","lessThan":"0c3ef71879c0264de6c42463031d9e057da87840","status":"affected","versionType":"git"},{"version":"11851cbd60ea1e5abbd97619d69845ead99303d6","lessThan":"1fef6614673ff0846d30acdeeaf3cf98bb5f6116","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ovpn/netlink.c","drivers/net/ovpn/peer.c","drivers/net/ovpn/peer.h"],"versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","status":"unaffected","versionType":"semver"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8298834912d76dbc82c12b6b4ab7590ed2bb8ae5"},{"url":"https://git.kernel.org/stable/c/0c3ef71879c0264de6c42463031d9e057da87840"},{"url":"https://git.kernel.org/stable/c/1fef6614673ff0846d30acdeeaf3cf98bb5f6116"}],"title":"ovpn: respect peer refcount in CMD_NEW_PEER error path","x_generator":{"engine":"bippy-1.2.0"}}}}