CVE-2026-74727

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Linux kernel's OpenVPN (ovpn) implementation. The function ovpn nl peer set doit() resolves a target peer using ovpn peer get by id() before acquiring the ovpn->lock. If a concurrent event such as OVPN CMD PEER DEL, keepalive expiry, or socket teardown occurs, ovpn peer remove() may unhash the peer from the by id, by vpn addr4/6, and by transp addr tables. Subsequently, ovpn nl peer set doit() acquires the lock and calls ovpn peer hash vpn ip(), which incorrectly re-inserts the removed peer into the rehashing tables. A similar race condition affects the float path in ovpn peer endpoints update(), which rehashes the peer in the by transp addr table after a delayed lock acquisition. This results in a resurrected peer that remains reachable via ovpn peer get by transp addr and TX VPN-IP lookups. When the data-path refcount drops, the peer is freed via call rcu while its hash entries remain linked, leading to a Use-After-Free (UAF) condition, where the system attempts to use memory that has already been released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.