CVE-2026-45918

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ovpn: tcp - don't deref NULL sk_socket member after tcp_close()

When deleting a peer in case of keepalive expiration, the peer is

removed from the OpenVPN hashtable and is temporary inserted in a

"release list" for further processing.

This happens in:

ovpn_peer_keepalive_work()

unlock_ovpn(release_list)

This processing includes detaching from the socket being used to

talk to this peer, by restoring its original proto and socket

ops/callbacks.

In case of TCP it may happen that, while the peer is sitting in

the release list, userspace decides to close the socket.

This will result in a concurrent execution of:

tcp_close(sk)

__tcp_close(sk)

sock_orphan(sk)

sk_set_socket(sk, NULL)

The last function call will set sk->sk_socket to NULL.

When the releasing routine is resumed, ovpn_tcp_socket_detach()

will attempt to dereference sk->sk_socket to restore its original

ops member. This operation will crash du

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References