CVE-2026-64044

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the OpenVPN implementation where the ovpn nl peer new doit() function error path calls ovpn peer release() directly instead of using ovpn peer put(). This bypasses the kref (kernel reference counting) mechanism. While this behavior is safe for UDP, it is problematic for TCP because ovpn socket new() and ovpn tcp socket attach() make the peer reachable via sk user data. If an error occurs during ovpn nl peer modify() or ovpn peer add(), the direct call to ovpn peer release() can destroy the peer while other processes, such as ovpn tcp recvmsg(), still hold a reference to it. This leads to a use-after-free scenario where a subsequent call to ovpn peer put() operates on freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.