CVE-2026-64044: ovpn: respect peer refcount in CMD_NEW_PEER error path
In the Linux kernel, the following vulnerability has been resolved:
ovpn: respect peer refcount in CMDNEWPEER error path
ovpnnlpeernewdoit()'s error path calls ovpnpeerrelease() directly rather than ovpnpeerput(), bypassing the kref. The accompanying comment ("peer was not yet hashed, thus it is not used in any context") holds for UDP but not for TCP.
For UDP, the ovpnsocket union uses the .ovpn arm and never points back at a peer; UDP encaprecv looks up peers via the not-yet-populated hashtables, so the new peer is unreachable until ovpnpeeradd() publishes it.
For TCP, ovpnsocketnew() sets ovpnsock->peer and ovpntcpsocketattach() publishes ovpnsock via rcuassignskuserdata(). From that moment until ovpnsocketrelease() detaches in the error path, the TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll on the fd, as well as the strparser-driven ovpntcprcv() path, can reach the peer through skuserdata -> ovpnsock->peer and bump its refcount via ovpnpeerhold().
ovpntcpsocketwaitfinish() (called inside ovpnsocketrelease()) drains strparser and the tx work, but does not synchronize with userspace syscall callers that already hold a peer reference. If ovpnnlpeermodify() or ovpnpeeradd() returns an error while such a caller is in flight - notably an ovpntcprecvmsg() blocked in skbrecvdatagram() on peer->tcp.userqueue - the direct ovpnpeerrelease() destroys the peer while the caller still holds the reference, and the eventual ovpnpeerput() from that caller operates on freed memory.
Replace the direct destructor call with ovpnpeerput() so the kref correctly defers destruction until the last reference is dropped. In the common case where no concurrent user is present, behaviour is unchanged: the kref hits zero immediately and ovpnpeerreleasekref() runs the same destructor.
With this conversion ovpnpeerrelease() has no callers outside peer.c - ovpnpeerreleasekref() in the same translation unit is the only remaining user - so make it static and drop its declaration from peer.h.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the ovpn CMD_NEW_PEER / ovpn_nl_peer_new_doit error paths, replace the direct ovpn_peer_release() destruction call with ovpn_peer_put() so the peer is deferred until the last reference is dropped and refcounting is respected (per: “Replace the direct destructor call with ovpn_peer_put() so the kref… correctly defers destruction until the last reference is dropped.” and “ovpn: respect peer refcount in CMD_NEW_PEER error path”).
Linux kernel ovpn (OpenVPN in-kernel module) ovpn_peer_release() caller behavior = Replace direct destructor call with ovpn_peer_put() - Compensating control
Avoid publishing/dereferencing peer objects via sk_user_data without proper refcount handling: ensure peers referenced through TCP sk_user_data (ovpn_sock->peer) are held/bumped so that later release occurs via ovpn_peer_put() rather than bypassing the kref (per: “reach the peer through sk_user_data -> ovpn_sock->peer and bump its refcount via ovpn_peer_hold()” and “rather than ovpn_peer_put(), bypassing the kref.”).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64044?
The severity of CVE-2026-64044 is high, with a CVSS score of 7.8.
How do I fix CVE-2026-64044?
To fix CVE-2026-64044, update the Linux kernel to a version where the vulnerability has been patched.
What systems are affected by CVE-2026-64044?
CVE-2026-64044 affects versions of the Linux kernel with the specific ovpn implementation.
What is the impact of CVE-2026-64044?
CVE-2026-64044 can lead to potential denial-of-service conditions or data corruption due to improper reference counting.
When was CVE-2026-64044 published?
CVE-2026-64044 was published on July 19, 2026.