CVE-2026-68122

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count leak occurs in the ovpn module during TCP RX or TX error paths. When ovpn peer hold() is called followed by schedule work() for the peer->tcp.defer del work item, a race condition can occur if the work item is already pending from another path. In such cases, schedule work() returns false and the work executes only once. Because the ovpn tcp peer del work() function calls ovpn peer put() only once, the additional reference created by the losing path is never released, leading to a leak of the peer object. This involves the ovpn peer hold(), ovpn peer put(), and ovpn tcp peer del work() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.