CVE-2026-64044

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ovpn: respect peer refcount in CMD_NEW_PEER error path

ovpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly

rather than ovpn_peer_put(), bypassing the kref. The accompanying

comment ("peer was not yet hashed, thus it is not used in any context")

holds for UDP but not for TCP.

For UDP, the ovpn_socket union uses the .ovpn arm and never points back

at a peer; UDP encap_recv looks up peers via the not-yet-populated

hashtables, so the new peer is unreachable until ovpn_peer_add()

publishes it.

For TCP, ovpn_socket_new() sets ovpn_sock->peer and

ovpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data().

From that moment until ovpn_socket_release() detaches in the error path,

the TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll

on the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can

reach the peer through sk_user_data -> ovpn_sock->peer and bump its

refcoun

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References