{"id":"CVE-2026-68122","summary":"ovpn: fix peer refcount leak in TCP error paths","details":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: fix peer refcount leak in TCP error paths\n\nWhen either the TCP RX or TX error path calls ovpn_peer_hold() followed\nby schedule_work(&peer-\u003etcp.defer_del_work), and the work item is already\npending from the other path, schedule_work() returns false and the work\nruns only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put()\nexactly once, the extra reference taken by the losing path is never\ndropped, leaking the peer object.\n\nThe race window:\n\n  CPU0 (strparser/RX error):       CPU1 (tcp_tx_work/TX error):\n  ovpn_peer_hold()   \u003c- refcnt+1   ovpn_peer_hold()   \u003c- refcnt+2\n  schedule_work()    \u003c- queued      schedule_work()    \u003c- NO-OP\n                                    (work already pending)\n  ovpn_tcp_peer_del_work runs:\n    ovpn_peer_del()\n    ovpn_peer_put()  \u003c- refcnt+1\n                                   \u003c- peer never freed\n\nFix by checking the return value of schedule_work() in both paths and\ncalling ovpn_peer_put() to drop the extra reference if the work was\nalready pending. ovpn_peer_hold() is kept unconditional in the TX path\nas it cannot fail at that point.","modified":"2026-08-18T03:31:09.461181722Z","published":"2026-08-10T11:58:42.477Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68122.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/63bbe18fc03062f483c627838a566a707b62da79"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b08526bf0bbf84ceebd29033783e8e0c9f451286"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f08f39c1f43f3980d46b06af8ed99ffe84ac294a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68122.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68122"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a6a5e87b3ee4cbf9c69a776565378c9b6a91dbfb"},{"fixed":"b08526bf0bbf84ceebd29033783e8e0c9f451286"},{"fixed":"f08f39c1f43f3980d46b06af8ed99ffe84ac294a"},{"fixed":"63bbe18fc03062f483c627838a566a707b62da79"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68122.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.16.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68122.json"}}],"schema_version":"1.9.0"}