CVE-2026-68122
Received Received - Intake

Reference Leak in OpenVPN Kernel Module TCP Paths

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpn_peer_hold() followed by schedule_work(&peer->tcp.defer_del_work), and the work item is already pending from the other path, schedule_work() returns false and the work runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object. The race window: CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error): ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2 schedule_work() <- queued schedule_work() <- NO-OP (work already pending) ovpn_tcp_peer_del_work runs: ovpn_peer_del() ovpn_peer_put() <- refcnt+1 <- peer never freed Fix by checking the return value of schedule_work() in both paths and calling ovpn_peer_put() to drop the extra reference if the work was already pending. ovpn_peer_hold() is kept unconditional in the TX path as it cannot fail at that point.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68122
EUVD
EUVD-2026-55503

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reference count leak in the Linux kernel's OpenVPN implementation. A race condition occurs when two CPU threads try to schedule the same cleanup work for a peer connection. One thread takes an extra reference to the peer but the cleanup work only runs once, leaving the extra reference un-released. This causes the peer object to leak and not be freed properly.

Detection Guidance

This vulnerability is specific to the Linux kernel's OpenVPN implementation and involves a peer reference count leak in TCP error paths. Detection requires checking kernel logs for TCP error path issues in OpenVPN or examining kernel memory for leaked peer objects. Commands like dmesg, journalctl -k, or checking /proc/net/openvpn may help identify abnormal behavior.

Impact Analysis

The leak could cause memory exhaustion over time as peer objects accumulate. Systems running OpenVPN with many connections may experience performance degradation or crashes due to running out of memory.

Mitigation Strategies

Apply the kernel patch that fixes the ovpn_peer_hold() and schedule_work() race condition. Update to a kernel version containing the fix or backport the patch manually. Restart OpenVPN services after applying the fix to ensure proper operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart