EUVD-2026-64414

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

PT-2026-79732

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by id ovpn nl peer set doit resolves the target peer via ovpn peer get by id before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequen...

Linux Distros Unpatched Vulnerability : CVE-2026-74727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window...

Linux Distros Unpatched Vulnerability : CVE-2026-68122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and t...

Linux Distros Unpatched Vulnerability : CVE-2026-68342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently...

CVE-2026-68122

A flaw was found in the Linux kernel's ovpn module. A race condition in the TCP error handling paths can lead to a reference count leak. This occurs when an internal object's reference count is incremented twice but decremented only once, preventing the object from being properly released. Over...

CVE-2026-68342

A flaw was found in the Linux kernel's OpenVPN ovpn module. During the destruction of an ovpn UDP socket, a race condition can occur where a new peer is published before the old socket is fully released. This can lead to a use-after-free vulnerability, allowing an attacker to potentially cause a...

CVE-2026-68341

A flaw was found in the Linux kernel's ovpn module. When the unlockovpn function processes a list of objects, it may attempt to access memory that has already been freed. This use-after-free vulnerability could potentially lead to system instability or, in more severe cases, arbitrary code...

CVE-2026-68341

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlockovpn unlockovpn iterates over the releaselist using llistforeachentry and drops the peer reference inside the loop body via ovpnpeerput. If this drops the last reference, the peer is eventually...

CVE-2026-68341

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlockovpn unlockovpn iterates over the releaselist using llistforeachentry and drops the peer reference inside the loop body via ovpnpeerput. If this drops the last reference, the peer is eventually...

CVE-2026-68342

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68122

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

UBUNTU-CVE-2026-68122

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68122

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68342 ovpn: avoid putting unrelated P2P peer on socket release

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68341

The CVE-2026-68341 issue affects the Linux kernel’s ovpn handling. In unlock_ovpn(), the code iterates a release_list with llist_for_each_entry() and drops peer references inside the loop via ovpn_peer_put(). If the last reference is dropped, the peer may be freed, but the loop’s advance uses pee...

EUVD-2026-55442

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlockovpn unlockovpn iterates over the releaselist using llistforeachentry and drops the peer reference inside the loop body via ovpnpeerput. If this drops the last reference, the peer is eventually...

CVE-2026-18602

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.getrecommendconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be...

CVE-2026-18602 GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.getrecommendconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be...