{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68122", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.369Z", "datePublished": "2026-08-10T11:58:42.477Z", "dateUpdated": "2026-08-17T04:59:13.088Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:59:13.088Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: fix peer refcount leak in TCP error paths\n\nWhen either the TCP RX or TX error path calls ovpn_peer_hold() followed\nby schedule_work(&peer->tcp.defer_del_work), and the work item is already\npending from the other path, schedule_work() returns false and the work\nruns only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put()\nexactly once, the extra reference taken by the losing path is never\ndropped, leaking the peer object.\n\nThe race window:\n\n CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error):\n ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2\n schedule_work() <- queued schedule_work() <- NO-OP\n (work already pending)\n ovpn_tcp_peer_del_work runs:\n ovpn_peer_del()\n ovpn_peer_put() <- refcnt+1\n <- peer never freed\n\nFix by checking the return value of schedule_work() in both paths and\ncalling ovpn_peer_put() to drop the extra reference if the work was\nalready pending. ovpn_peer_hold() is kept unconditional in the TX path\nas it cannot fail at that point."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ovpn/tcp.c"], "versions": [{"version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb", "lessThan": "b08526bf0bbf84ceebd29033783e8e0c9f451286", "status": "affected", "versionType": "git"}, {"version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb", "lessThan": "f08f39c1f43f3980d46b06af8ed99ffe84ac294a", "status": "affected", "versionType": "git"}, {"version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb", "lessThan": "63bbe18fc03062f483c627838a566a707b62da79", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ovpn/tcp.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b08526bf0bbf84ceebd29033783e8e0c9f451286"}, {"url": "https://git.kernel.org/stable/c/f08f39c1f43f3980d46b06af8ed99ffe84ac294a"}, {"url": "https://git.kernel.org/stable/c/63bbe18fc03062f483c627838a566a707b62da79"}], "title": "ovpn: fix peer refcount leak in TCP error paths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ovpn/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b08526bf0bbf84ceebd29033783e8e0c9f451286", "status": "affected", "version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb", "versionType": "git"}, {"lessThan": "f08f39c1f43f3980d46b06af8ed99ffe84ac294a", "status": "affected", "version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb", "versionType": "git"}, {"lessThan": "63bbe18fc03062f483c627838a566a707b62da79", "status": "affected", "version": "a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ovpn/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: fix peer refcount leak in TCP error paths\n\nWhen either the TCP RX or TX error path calls ovpn_peer_hold() followed\nby schedule_work(&peer->tcp.defer_del_work), and the work item is already\npending from the other path, schedule_work() returns false and the work\nruns only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put()\nexactly once, the extra reference taken by the losing path is never\ndropped, leaking the peer object.\n\nThe race window:\n\n CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error):\n ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2\n schedule_work() <- queued schedule_work() <- NO-OP\n (work already pending)\n ovpn_tcp_peer_del_work runs:\n ovpn_peer_del()\n ovpn_peer_put() <- refcnt+1\n <- peer never freed\n\nFix by checking the return value of schedule_work() in both paths and\ncalling ovpn_peer_put() to drop the extra reference if the work was\nalready pending. ovpn_peer_hold() is kept unconditional in the TX path\nas it cannot fail at that point."}], "id": "CVE-2026-68122", "lastModified": "2026-08-17T05:18:11.810", "metrics": {}, "published": "2026-08-10T13:19:57.317", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63bbe18fc03062f483c627838a566a707b62da79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b08526bf0bbf84ceebd29033783e8e0c9f451286"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f08f39c1f43f3980d46b06af8ed99ffe84ac294a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel: Resource leak in ovpn TCP error paths", "id": "2513340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513340"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\novpn: fix peer refcount leak in TCP error paths\nWhen either the TCP RX or TX error path calls ovpn_peer_hold() followed\nby schedule_work(&peer->tcp.defer_del_work), and the work item is already\npending from the other path, schedule_work() returns false and the work\nruns only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put()\nexactly once, the extra reference taken by the losing path is never\ndropped, leaking the peer object.\nThe race window:\nCPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error):\novpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2\nschedule_work() <- queued schedule_work() <- NO-OP\n(work already pending)\novpn_tcp_peer_del_work runs:\novpn_peer_del()\novpn_peer_put() <- refcnt+1\n<- peer never freed\nFix by checking the return value of schedule_work() in both paths and\ncalling ovpn_peer_put() to drop the extra reference if the work was\nalready pending. ovpn_peer_hold() is kept unconditional in the TX path\nas it cannot fail at that point.", "A flaw was found in the Linux kernel's ovpn module. A race condition in the TCP error handling paths can lead to a reference count leak. This occurs when an internal object's reference count is incremented twice but decremented only once, preventing the object from being properly released. Over time, this resource exhaustion could lead to a Denial of Service (DoS) condition."], "name": "CVE-2026-68122", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T11:58:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68122\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68122\nhttps://git.kernel.org/stable/c/63bbe18fc03062f483c627838a566a707b62da79\nhttps://git.kernel.org/stable/c/b08526bf0bbf84ceebd29033783e8e0c9f451286\nhttps://git.kernel.org/stable/c/f08f39c1f43f3980d46b06af8ed99ffe84ac294a"], "threat_severity": "Important"}