Race Condition Vulnerability in Linux Kernel's OpenVPN Module

CVE-2026-74727

What is CVE-2026-74727?

A vulnerability in the OpenVPN module of the Linux kernel can lead to a race condition when resolving target peers. The function ovpn_nl_peer_set_doit() can reference a peer before acquiring the necessary lock, allowing for a scenario where a peer is concurrently removed from data tables. Because of this race, the removed peer can be reinserted inadvertently into hash tables, allowing it to become accessible from the RX and TX operations even though the peer is believed to be deleted. This can lead to a use-after-free (UAF) situation when the reference count drops, which threatens system integrity and security. This vulnerability has been addressed by implementing additional checks to prevent the rehashing of already removed peers.

References