{"id":"CVE-2026-64044","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-64044","generatedAt":"2026-10-28T04:11:24.634Z","title":"In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly rather than ovpn_peer_put(), bypassing the kref.","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: respect peer refcount in CMD_NEW_PEER error path\n\novpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly\nrather than ovpn_peer_put(), bypassing the kref. The accompanying\ncomment (\"peer was not yet hashed, thus it is not used in any context\")\nholds for UDP but not for TCP.\n\nFor UDP, the ovpn_socket union uses the .ovpn arm and never points back\nat a peer; UDP encap_recv looks up peers via the not-yet-populated\nhashtables, so the new peer is unreachable until ovpn_peer_add()\npublishes it.\n\nFor TCP, ovpn_socket_new() sets ovpn_sock->peer and\novpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data().\nFrom that moment until ovpn_socket_release() detaches in the error path,\nthe TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll\non the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can\nreach the peer through sk_user_data -> ovpn_sock->peer and bump its\nrefcount via ovpn_peer_hold().\n\novpn_tcp_socket_wait_finish() (called inside ovpn_socket_release())\ndrains strparser and the tx work, but does not synchronize with\nuserspace syscall callers that already hold a peer reference. If\novpn_nl_peer_modify() or ovpn_peer_add() returns an error while such\na caller is in flight - notably an ovpn_tcp_recvmsg() blocked in\n__skb_recv_datagram() on peer->tcp.user_queue - the direct\novpn_peer_release() destroys the peer while the caller still holds\nthe reference, and the eventual ovpn_peer_put() from that caller\noperates on freed memory.\n\nReplace the direct destructor call with ovpn_peer_put() so the kref\ncorrectly defers destruction until the last reference is dropped.\nIn the common case where no concurrent user is present, behaviour is\nunchanged: the kref hits zero immediately and ovpn_peer_release_kref()\nruns the same destructor.\n\nWith this conversion ovpn_peer_release() has no callers outside peer.c\n- ovpn_peer_release_kref() in the same translation unit is the only\nremaining user - so make it static and drop its declaration from\npeer.h.","published":"2026-07-19T16:17:45.000Z","lastModified":"2026-09-02T21:11:32.000Z","status":"Analyzed","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":[],"affected":["linux/linux kernel"],"epss":{"score":0.00184,"percentile":0.07894,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/0c3ef71879c0264de6c42463031d9e057da87840","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1fef6614673ff0846d30acdeeaf3cf98bb5f6116","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8298834912d76dbc82c12b6b4ab7590ed2bb8ae5","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64044","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}