« Volver al listado

CVE-2026-68122

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ovpn: fix peer refcount leak in TCP error paths

When either the TCP RX or TX error path calls ovpn_peer_hold() followed by schedule_work(&peer->tcp.defer_del_work), and the work item is already pending from the other path, schedule_work() returns false and the work runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object.

The race window:

Fix by checking the return value of schedule_work() in both paths and calling ovpn_peer_put() to drop the extra reference if the work was already pending. ovpn_peer_hold() is kept unconditional in the TX path as it cannot fail at that point.

Detalles técnicos trazas, registros y código del informe original
  CPU0 (strparser/RX error):       CPU1 (tcp_tx_work/TX error):
  ovpn_peer_hold()   <- refcnt+1   ovpn_peer_hold()   <- refcnt+2
  schedule_work()    <- queued      schedule_work()    <- NO-OP
                                    (work already pending)
  ovpn_tcp_peer_del_work runs:
    ovpn_peer_del()
    ovpn_peer_put()  <- refcnt+1
                                   <- peer never freed

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68122",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb",
              "lessThan": "b08526bf0bbf84ceebd29033783e8e0c9f451286",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb",
              "lessThan": "f08f39c1f43f3980d46b06af8ed99ffe84ac294a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb",
              "lessThan": "63bbe18fc03062f483c627838a566a707b62da79",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ovpn/tcp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ovpn/tcp.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:19:57.317",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/63bbe18fc03062f483c627838a566a707b62da79",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b08526bf0bbf84ceebd29033783e8e0c9f451286",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f08f39c1f43f3980d46b06af8ed99ffe84ac294a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: fix peer refcount leak in TCP error paths\n\nWhen either the TCP RX or TX error path calls ovpn_peer_hold() followed\nby schedule_work(&peer->tcp.defer_del_work), and the work item is already\npending from the other path, schedule_work() returns false and the work\nruns only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put()\nexactly once, the extra reference taken by the losing path is never\ndropped, leaking the peer object.\n\nThe race window:\n\n  CPU0 (strparser/RX error):       CPU1 (tcp_tx_work/TX error):\n  ovpn_peer_hold()   <- refcnt+1   ovpn_peer_hold()   <- refcnt+2\n  schedule_work()    <- queued      schedule_work()    <- NO-OP\n                                    (work already pending)\n  ovpn_tcp_peer_del_work runs:\n    ovpn_peer_del()\n    ovpn_peer_put()  <- refcnt+1\n                                   <- peer never freed\n\nFix by checking the return value of schedule_work() in both paths and\ncalling ovpn_peer_put() to drop the extra reference if the work was\nalready pending. ovpn_peer_hold() is kept unconditional in the TX path\nas it cannot fail at that point."
    }
  ],
  "lastModified": "2026-08-17T05:18:11.810",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}