CVE-2026-68341

Received Received - Intake

Use After Free in Linux Kernel OpenVPN

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlock_ovpn() unlock_ovpn() iterates over the release_list using llist_for_each_entry() and drops the peer reference inside the loop body via ovpn_peer_put(). If this drops the last reference, the peer is eventually freed. However, llist_for_each_entry() reads peer->release_entry.next in the loop advance expression, which runs after the body. By that time the peer may have already been freed, resulting in a use after free when advancing to the next list entry. Fix this by using llist_for_each_entry_safe(), which caches the next pointer before executing the loop body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68341

EUVD

EUVD-2026-55442

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's OpenVPN implementation. The unlock_ovpn() function incorrectly iterates over a list of peers to release references. If a peer's reference count drops to zero during iteration, the peer is freed while the loop still tries to access it, causing a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's OpenVPN implementation and requires kernel-level detection. No direct commands are provided in the context to detect this use-after-free issue. Monitoring kernel logs for crashes or enabling KASAN (Kernel Address Sanitizer) may help identify such issues.

Impact Analysis

This could lead to system crashes, privilege escalation, or arbitrary code execution if exploited. Attackers might gain control over the affected system by triggering the use-after-free condition.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's OpenVPN implementation, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Apply the kernel patch that fixes this issue by updating to a version that includes the fix for unlock_ovpn(). If a patch is not available, consider disabling the affected OpenVPN functionality until an update is applied.

Hi! I’m here to help you understand CVE-2026-68341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70