HarborGuard / CVE
Back to search
HIGHCVE-2026-45929Published Modified CNA Linux

CVE-2026-45929: ovpn: fix possible use-after-free in ovpn_net_xmit

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix possible use-after-free in ovpn_net_xmit When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - peer lookup, - skb_dst_drop (even though all segments produced by skb_gso_segment will have a dst attached), - ovpn_peer_stats_increment_tx. Fix this by moving the peer lookup and skb_dst_drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb_share_check and the list ends up empty. Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next patch fixes the stats logic.

Metrics

CVSS v3.1
7.8
Severity
HIGH
Fixed in
0
Affected Products
2

Fix available

03e4fbcb4e078915367ba5576cd70d76dbc970f95442915c96a9bff1c7080e2aedabb1c03faa28d816.18.146.19.47.0a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41
Affected packages
  • Linux / Linux
    < 3e4fbcb4e078915367ba5576cd70d76dbc970f95 (from 08857b5ec5d91d83e69e40a36554a8c7557b7301) · < 442915c96a9bff1c7080e2aedabb1c03faa28d81 (from 08857b5ec5d91d83e69e40a36554a8c7557b7301) · < a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41 (from 08857b5ec5d91d83e69e40a36554a8c7557b7301)
  • Linux / Linux
    6.16
    Fixed in 0, 6.18.14, 6.19.4, 7.0
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H