CVE-2026-68122

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ovpn: fix peer refcount leak in TCP error paths<br /> <br /> When either the TCP RX or TX error path calls ovpn_peer_hold() followed<br /> by schedule_work(&amp;peer-&gt;tcp.defer_del_work), and the work item is already<br /> pending from the other path, schedule_work() returns false and the work<br /> runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put()<br /> exactly once, the extra reference taken by the losing path is never<br /> dropped, leaking the peer object.<br /> <br /> The race window:<br /> <br /> CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error):<br /> ovpn_peer_hold()