CVE-2026-45929: ovpn: fix possible use-after-free in ovpn_net_xmit
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix possible use-after-free in ovpnnetxmit
When building the skblist in ovpnnetxmit, skbsharecheck will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - peer lookup, - skbdstdrop (even though all segments produced by skbgsosegment will have a dst attached), - ovpnpeerstatsincrementtx.
Fix this by moving the peer lookup and skbdstdrop before segmentation so that the original skb is still valid when used. Return early if all segments fail skbsharecheck and the list ends up empty. Also switch ovpnpeerstatsincrementtx to use skblist.next; the next patch fixes the stats logic.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The severity vector indicates local access and low privileges are required. No user interaction is required.
What is the potential impact if exploitation succeeds?
The severity vector rates confidentiality, integrity, and availability impact as high. The flaw is a use-after-free in the OpenVPN data-path transmit handling.
Which systems are exposed?
Systems running the Linux kernel with the affected ovpn transmit path are relevant. The provided data does not identify affected or fixed kernel versions.
How can I remediate this vulnerability?
Apply a Linux kernel update containing the upstream stable fixes referenced in the advisory. The provided data does not describe a configuration workaround if updating is not immediately possible.