CVE-2026-68341

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use after free issue exists in the unlock ovpn() function. The function iterates over the release list using llist for each entry() and drops the peer reference via ovpn peer put(). If the last reference is dropped, the peer is freed. Because llist for each entry() reads the next pointer after the loop body executes, it may attempt to access memory that has already been freed when advancing to the next entry.

Recommendations Update the Linux kernel to a version where the unlock ovpn() function has been patched to use llist for each entry safe(), which caches the next pointer before executing the loop body.