CVE-2026-64043

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the ovpn module during the deletion of an interface. A narrow window occurs during the ovpn dellink() process where a CMD PEER NEW message sent via netlink to add a new peer can cause the netdevice to hang and prevent its unregistration. This happens because the new peer takes a reference to the netdev after the system has already assumed all peers were released and the device was queued for deregistration, leaving no way to release the device.

Recommendations Update the Linux kernel to a version where the ovpn peer add() function includes a check for the reg state to ensure it is REGISTERED before adding a peer, and where peer release is handled in ndo uninit().