{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-64044", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.029Z", "datePublished": "2026-07-19T15:39:29.869Z", "dateUpdated": "2026-08-05T12:38:36.035Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:36.035Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: respect peer refcount in CMD_NEW_PEER error path\n\novpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly\nrather than ovpn_peer_put(), bypassing the kref. The accompanying\ncomment (\"peer was not yet hashed, thus it is not used in any context\")\nholds for UDP but not for TCP.\n\nFor UDP, the ovpn_socket union uses the .ovpn arm and never points back\nat a peer; UDP encap_recv looks up peers via the not-yet-populated\nhashtables, so the new peer is unreachable until ovpn_peer_add()\npublishes it.\n\nFor TCP, ovpn_socket_new() sets ovpn_sock->peer and\novpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data().\nFrom that moment until ovpn_socket_release() detaches in the error path,\nthe TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll\non the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can\nreach the peer through sk_user_data -> ovpn_sock->peer and bump its\nrefcount via ovpn_peer_hold().\n\novpn_tcp_socket_wait_finish() (called inside ovpn_socket_release())\ndrains strparser and the tx work, but does not synchronize with\nuserspace syscall callers that already hold a peer reference. If\novpn_nl_peer_modify() or ovpn_peer_add() returns an error while such\na caller is in flight - notably an ovpn_tcp_recvmsg() blocked in\n__skb_recv_datagram() on peer->tcp.user_queue - the direct\novpn_peer_release() destroys the peer while the caller still holds\nthe reference, and the eventual ovpn_peer_put() from that caller\noperates on freed memory.\n\nReplace the direct destructor call with ovpn_peer_put() so the kref\ncorrectly defers destruction until the last reference is dropped.\nIn the common case where no concurrent user is present, behaviour is\nunchanged: the kref hits zero immediately and ovpn_peer_release_kref()\nruns the same destructor.\n\nWith this conversion ovpn_peer_release() has no callers outside peer.c\n- ovpn_peer_release_kref() in the same translation unit is the only\nremaining user - so make it static and drop its declaration from\npeer.h." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is triggered from the OVPN_CMD_PEER_NEW genetlink handler reached only via local netlink syscalls; remote TCP data can participate in the race but cannot alone reach the premature ovpn_peer_release() error path.\nAC:L - Exploitation requires a race between a failing CMD_NEW_PEER netlink message and a concurrent local holder of a peer reference, and the attacker controls both sides by blocking recvmsg on the TCP fd while issuing the failing netlink command.\nPR:L - All OVPN genetlink operations require GENL_ADMIN_PERM (CAP_NET_ADMIN), and creating the ovpn interface requires the same capability, which an unprivileged user can obtain inside a user namespace.\nUI:N - No victim interaction is required; the attacker configures the ovpn interface, TCP socket, and concurrent threads themselves to trigger the error-path UAF.\nS:U - The UAF corrupts kernel heap memory and enables standard kernel privilege escalation within the same security authority, not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free of struct ovpn_peer allows an attacker to read freed slab memory and obtain arbitrary kernel memory disclosure primitives.\nI:H - Use-after-free of struct ovpn_peer enables heap grooming and control of freed object contents, providing a path to arbitrary kernel memory writes and code execution.\nA:H - The UAF causes ovpn_peer_put() to operate on freed memory, which can trigger kernel oops, panic, or crash during reference decrements on corrupted kref state." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ovpn/netlink.c", "drivers/net/ovpn/peer.c", "drivers/net/ovpn/peer.h" ], "versions": [ { "version": "11851cbd60ea1e5abbd97619d69845ead99303d6", "lessThan": "8298834912d76dbc82c12b6b4ab7590ed2bb8ae5", "status": "affected", "versionType": "git" }, { "version": "11851cbd60ea1e5abbd97619d69845ead99303d6", "lessThan": "0c3ef71879c0264de6c42463031d9e057da87840", "status": "affected", "versionType": "git" }, { "version": "11851cbd60ea1e5abbd97619d69845ead99303d6", "lessThan": "1fef6614673ff0846d30acdeeaf3cf98bb5f6116", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ovpn/netlink.c", "drivers/net/ovpn/peer.c", "drivers/net/ovpn/peer.h" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8298834912d76dbc82c12b6b4ab7590ed2bb8ae5" }, { "url": "https://git.kernel.org/stable/c/0c3ef71879c0264de6c42463031d9e057da87840" }, { "url": "https://git.kernel.org/stable/c/1fef6614673ff0846d30acdeeaf3cf98bb5f6116" } ], "title": "ovpn: respect peer refcount in CMD_NEW_PEER error path", "x_generator": { "engine": "bippy-1.2.0" } } } }