CVE-2026-43254
TCP Packet Handling Vulnerability in Linux Kernel OpenVPN
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openvpn | openvpn | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's handling of TCP stream data in the OpenVPN component (ovpn_tcp_recv). When processing large cloned socket buffers (skbs) that contain multiple coalesced packets, two main bugs occur:
- Header offset overflow: Using pskb_pull with large offsets causes the network header offset to exceed its storage limit, leading to failures in resetting the network header and resulting in packet drops.
- Unaligned protocol headers: Extracting packets from arbitrary positions within the TCP stream causes misalignment of packet data, which leads to performance penalties on architectures that do not support efficient unaligned access. Additionally, OpenVPN's 2-byte length prefix causes subsequent fields to be inherently misaligned.
The fix involves allocating a new skb for each OpenVPN packet and copying only the packet content (skipping the 2-byte length prefix) into this new buffer. This avoids misalignment and header offset issues, prevents invalid skb creation, and improves TCP throughput by up to 74%.
How can this vulnerability impact me? :
This vulnerability can cause packet drops due to header offset overflow and performance degradation due to unaligned protocol headers when processing TCP stream data in OpenVPN. Packet drops can lead to unreliable VPN connections, while performance penalties can reduce throughput and efficiency, especially on architectures sensitive to unaligned memory access.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved in the Linux kernel by fixing the packet extraction process in ovpn_tcp_recv. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
The fix involves allocating a new skb for each OpenVPN packet and using skb_copy_bits to extract only the packet content, avoiding header offset overflow and unaligned protocol headers.
Applying the updated kernel will also improve TCP throughput and prevent packet drops caused by the previous bugs.