CVE-2026-68341ovpn: fix use after free in unlock_ovpn()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlock_ovpn() unlock_ovpn() iterates over the release_list using llist_for_each_entry() and drops the peer reference inside the loop body via ovpn_peer_put(). If this drops the last reference, the peer is eventually freed. However, llist_for_each_entry() reads peer->release_entry.next in the loop advance expression, which runs after the body. By that time the peer may have already been freed, resulting in a use after free when advancing to the next list entry. Fix this by using llist_for_each_entry_safe(), which caches the next pointer before executing the loop body.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 80747caef33d77f5c1b3d24644e6d7dae69066b5 builds before 5b96227c0e8b212b74838424c929fc889aedb555; 80747caef33d77f5c1b3d24644e6d7dae69066b5 builds before 4cdb209f12a89c5faf9be0c45edb90ccdf65db0c; from 80747caef33d77f5c1b3d24644e6d7dae69066b5 before e1ad6fe5db719874efa45b2caf9934552e09fc43 | CNA record |
References
- https://git.kernel.org/stable/c/5b96227c0e8b212b74838424c929fc889aedb555
- https://git.kernel.org/stable/c/4cdb209f12a89c5faf9be0c45edb90ccdf65db0c
- https://git.kernel.org/stable/c/e1ad6fe5db719874efa45b2caf9934552e09fc43
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.