CVE-2026-68341: ovpn: fix use after free in unlock_ovpn()
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix use after free in unlockovpn()
unlockovpn() iterates over the releaselist using llistforeachentry() and drops the peer reference inside the loop body via ovpnpeerput().
If this drops the last reference, the peer is eventually freed. However, llistforeachentry() reads peer->releaseentry.next in the loop advance expression, which runs after the body. By that time the peer may have already been freed, resulting in a use after free when advancing to the next list entry.
Fix this by using llistforeachentrysafe(), which caches the next pointer before executing the loop body.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In unlock_ovpn(), iterate the release_list using llist_for_each_entry_safe() (instead of llist_for_each_entry()) so the loop advance caches peer->release_entry.next before ovpn_peer_put() potentially drops the last reference and frees the peer.
Linux kernel (ovpn) unlock_ovpn() iteration over release_list = Replace llist_for_each_entry() with llist_for_each_entry_safe() to cache the next pointer before executing the loop body.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68341?
CVE-2026-68341 has a risk rating of 34.
What type of vulnerability is CVE-2026-68341?
CVE-2026-68341 is classified as a use after free vulnerability.
How do I fix CVE-2026-68341?
To fix CVE-2026-68341, update to the patched version of the Linux kernel released on or after August 10, 2026.
What software is affected by CVE-2026-68341?
CVE-2026-68341 affects the Linux kernel, specifically the ovpn module.
What is the impact of CVE-2026-68341?
The impact of CVE-2026-68341 could potentially lead to software crashes or exploitation if the use after free condition is triggered.