PT-2026-61361 · Linux · Linux
CVE-2026-64044
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ovpn: respect peer refcount in CMD NEW PEER error path
ovpn nl peer new doit()'s error path calls ovpn peer release() directly
rather than ovpn peer put(), bypassing the kref. The accompanying
comment ("peer was not yet hashed, thus it is not used in any context")
holds for UDP but not for TCP.
For UDP, the ovpn socket union uses the .ovpn arm and never points back
at a peer; UDP encap recv looks up peers via the not-yet-populated
hashtables, so the new peer is unreachable until ovpn peer add()
publishes it.
For TCP, ovpn socket new() sets ovpn sock->peer and
ovpn tcp socket attach() publishes ovpn sock via rcu assign sk user data().
From that moment until ovpn socket release() detaches in the error path,
the TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll
on the fd, as well as the strparser-driven ovpn tcp rcv() path, can
reach the peer through sk user data -> ovpn sock->peer and bump its
refcount via ovpn peer hold().
ovpn tcp socket wait finish() (called inside ovpn socket release())
drains strparser and the tx work, but does not synchronize with
userspace syscall callers that already hold a peer reference. If
ovpn nl peer modify() or ovpn peer add() returns an error while such
a caller is in flight - notably an ovpn tcp recvmsg() blocked in
skb recv datagram() on peer->tcp.user queue - the direct
ovpn peer release() destroys the peer while the caller still holds
the reference, and the eventual ovpn peer put() from that caller
operates on freed memory.
Replace the direct destructor call with ovpn peer put() so the kref
correctly defers destruction until the last reference is dropped.
In the common case where no concurrent user is present, behaviour is
unchanged: the kref hits zero immediately and ovpn peer release kref()
runs the same destructor.
With this conversion ovpn peer release() has no callers outside peer.c
- ovpn peer release kref() in the same translation unit is the only remaining user - so make it static and drop its declaration from peer.h.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux