CVE-2026-45929ovpn: fix possible use-after-free in ovpn_net_xmit
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix possible use-after-free in ovpn_net_xmit When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - peer lookup, - skb_dst_drop (even though all segments produced by skb_gso_segment will have a dst attached), - ovpn_peer_stats_increment_tx. Fix this by moving the peer lookup and skb_dst_drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb_share_check and the list ends up empty. Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next patch fixes the stats logic.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 08857b5ec5d91d83e69e40a36554a8c7557b7301 builds before 3e4fbcb4e078915367ba5576cd70d76dbc970f95; from 08857b5ec5d91d83e69e40a36554a8c7557b7301 before 442915c96a9bff1c7080e2aedabb1c03faa28d81; from 08857b5ec5d91d83e69e40a36554a8c7557b7301 before a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.16 before 6.18.14; from 6.19 before 6.19.4 | NVD |
References
- https://git.kernel.org/stable/c/3e4fbcb4e078915367ba5576cd70d76dbc970f95patch
- https://git.kernel.org/stable/c/442915c96a9bff1c7080e2aedabb1c03faa28d81patch
- https://git.kernel.org/stable/c/a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.