PT-2026-43796 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-45929

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ovpn: fix possible use-after-free in ovpn net xmit

When building the skb list in ovpn net xmit, skb share check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations:

• peer lookup,
• skb dst drop (even though all segments produced by skb gso segment will have a dst attached),
• ovpn peer stats increment tx.

Fix this by moving the peer lookup and skb dst drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb share check and the list ends up empty. Also switch ovpn peer stats increment tx to use skb list.next; the next patch fixes the stats logic.

Fix

Related Identifiers

CVE-2026-45929

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-45929 · Security Note
• https://git.kernel.org/stable/c/442915c96a9bff1c7080e2aedabb1c03faa28d81 · Note
• https://git.kernel.org/stable/c/a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41 · Note
• https://git.kernel.org/stable/c/3e4fbcb4e078915367ba5576cd70d76dbc970f95 · Note