CVE-2026-64044

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ovpn: respect peer refcount in CMD_NEW_PEER error path<br /> <br /> ovpn_nl_peer_new_doit()&amp;#39;s error path calls ovpn_peer_release() directly<br /> rather than ovpn_peer_put(), bypassing the kref. The accompanying<br /> comment ("peer was not yet hashed, thus it is not used in any context")<br /> holds for UDP but not for TCP.<br /> <br /> For UDP, the ovpn_socket union uses the .ovpn arm and never points back<br /> at a peer; UDP encap_recv looks up peers via the not-yet-populated<br /> hashtables, so the new peer is unreachable until ovpn_peer_add()<br /> publishes it.<br /> <br /> For TCP, ovpn_socket_new() sets ovpn_sock-&gt;peer and<br /> ovpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data().<br /> From that moment until ovpn_socket_release() detaches in the error path,<br /> the TCP fd is fully wired: userspace recvmsg / sendmsg / close / poll<br /> on the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can<br /> reach the peer through sk_user_data -&gt; ovpn_sock-&gt;peer and bump its<br /> refcount via ovpn_peer_hold().<br /> <br /> ovpn_tcp_socket_wait_finish() (called inside ovpn_socket_release())<br /> drains strparser and the tx work, but does not synchronize with<br /> userspace syscall callers that already hold a peer reference. If<br /> ovpn_nl_peer_modify() or ovpn_peer_add() returns an error while such<br /> a caller is in flight - notably an ovpn_tcp_recvmsg() blocked in<br /> __skb_recv_datagram() on peer-&gt;tcp.user_queue - the direct<br /> ovpn_peer_release() destroys the peer while the caller still holds<br /> the reference, and the eventual ovpn_peer_put() from that caller<br /> operates on freed memory.<br /> <br /> Replace the direct destructor call with ovpn_peer_put() so the kref<br /> correctly defers destruction until the last reference is dropped.<br /> In the common case where no concurrent user is present, behaviour is<br /> unchanged: the kref hits zero immediately and ovpn_peer_release_kref()<br /> runs the same destructor.<br /> <br /> With this conversion ovpn_peer_release() has no callers outside peer.c<br /> - ovpn_peer_release_kref() in the same translation unit is the only<br /> remaining user - so make it static and drop its declaration from<br /> peer.h.