CVE-2026-68122: ovpn: fix peer refcount leak in TCP error paths

In the Linux kernel, the following vulnerability has been resolved:

ovpn: fix peer refcount leak in TCP error paths

When either the TCP RX or TX error path calls ovpnpeerhold() followed by schedulework(&peer->tcp.deferdelwork), and the work item is already pending from the other path, schedulework() returns false and the work runs only once. Since ovpntcppeerdelwork() calls ovpnpeerput() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object.

The race window:

CPU0 (strparser/RX error): CPU1 (tcptxwork/TX error): ovpnpeerhold() <- refcnt+1 ovpnpeerhold() <- refcnt+2 schedulework() <- queued schedulework() <- NO-OP (work already pending) ovpntcppeerdelwork runs: ovpnpeerdel() ovpnpeerput() <- refcnt+1 <- peer never freed

Fix by checking the return value of schedulework() in both paths and calling ovpnpeerput() to drop the extra reference if the work was already pending. ovpnpeerhold() is kept unconditional in the TX path as it cannot fail at that point.