CVE-2026-64045

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the ovpn tcp close() function. The function loads the ovpn socket using rcu dereference sk user data() under an RCU read lock, caches the peer pointer, and then drops the lock. However, it subsequently passes sock->peer to ovpn peer del() instead of using the cached local pointer, which results in re-dereferencing the ovpn socket after the RCU read section has ended. Because ovpn tcp close() operates without the socket lock, ovpn socket release() can concurrently execute the sequence of releasing and freeing the socket. This allows a window where the socket can be freed before the pointer is dereferenced. This issue can be triggered when a peer removal occurs simultaneously with the closure of the TCP file descriptor by userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.