CVE-2026-74727 (GCVE-0-2026-74727)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
ovpn: skip rehash for peers already removed from by_id
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovpn: skip rehash for peers already removed from by_id
ovpn_nl_peer_set_doit() resolves the target peer via
ovpn_peer_get_by_id() before taking ovpn->lock. In the window between
the lookup (which only takes a refcount) and the subsequent
spin_lock_bh(&ovpn->lock), a concurrent OVPN_CMD_PEER_DEL, keepalive
expiry, or socket teardown can take ovpn->lock first, run
ovpn_peer_remove() to unhash the peer from all four tables (by_id,
by_vpn_addr4/6, by_transp_addr) and release the lock. set_doit then
acquires ovpn->lock and calls ovpn_peer_hash_vpn_ip(), which
re-inserts the now-removed peer back into the rehashing tables.
The same race affects the float path: ovpn_peer_endpoints_update()
holds only a refcount and acquires ovpn->lock very late (after async
AEAD decrypt and a netlink notification), then rehashes the peer
in the by_transp_addr table.
The resurrected peer becomes reachable again from the RX lookup
(ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though
userspace believes it is gone. Once the data-path refcount drops the
peer is freed via call_rcu while the hash entries embedded in it
remain linked, opening a UAF window.
Bail out of the rehash when hash_entry_id is unhashed, mirroring
the sentinel already used by ovpn_peer_remove() to detect the
already-removed state. The check is safe under ovpn->lock, which
serializes every mutation of hash_entry_id, and is a no-op for the
add path because ovpn_peer_add_mp() inserts hash_entry_id before
calling ovpn_peer_hash_vpn_ip().
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1d36a36f6d5347360ef9681a05f6166683bafd1d , < d20c181088984b6eaa8d7fe7cb5ab3510988df59
(git)
Affected: 1d36a36f6d5347360ef9681a05f6166683bafd1d , < 66745480298775f188b2f5ad266643e85a90f73b (git) Affected: 1d36a36f6d5347360ef9681a05f6166683bafd1d , < 33ec10567fe14456063daf549fdf1a4f53448e4c (git) |
guessed | |
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/peer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d20c181088984b6eaa8d7fe7cb5ab3510988df59",
"status": "affected",
"version": "1d36a36f6d5347360ef9681a05f6166683bafd1d",
"versionType": "git"
},
{
"lessThan": "66745480298775f188b2f5ad266643e85a90f73b",
"status": "affected",
"version": "1d36a36f6d5347360ef9681a05f6166683bafd1d",
"versionType": "git"
},
{
"lessThan": "33ec10567fe14456063daf549fdf1a4f53448e4c",
"status": "affected",
"version": "1d36a36f6d5347360ef9681a05f6166683bafd1d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/peer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: skip rehash for peers already removed from by_id\n\novpn_nl_peer_set_doit() resolves the target peer via\novpn_peer_get_by_id() before taking ovpn-\u003elock. In the window between\nthe lookup (which only takes a refcount) and the subsequent\nspin_lock_bh(\u0026ovpn-\u003elock), a concurrent OVPN_CMD_PEER_DEL, keepalive\nexpiry, or socket teardown can take ovpn-\u003elock first, run\novpn_peer_remove() to unhash the peer from all four tables (by_id,\nby_vpn_addr4/6, by_transp_addr) and release the lock. set_doit then\nacquires ovpn-\u003elock and calls ovpn_peer_hash_vpn_ip(), which\nre-inserts the now-removed peer back into the rehashing tables.\n\nThe same race affects the float path: ovpn_peer_endpoints_update()\nholds only a refcount and acquires ovpn-\u003elock very late (after async\nAEAD decrypt and a netlink notification), then rehashes the peer\nin the by_transp_addr table.\n\nThe resurrected peer becomes reachable again from the RX lookup\n(ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though\nuserspace believes it is gone. Once the data-path refcount drops the\npeer is freed via call_rcu while the hash entries embedded in it\nremain linked, opening a UAF window.\n\nBail out of the rehash when hash_entry_id is unhashed, mirroring\nthe sentinel already used by ovpn_peer_remove() to detect the\nalready-removed state. The check is safe under ovpn-\u003elock, which\nserializes every mutation of hash_entry_id, and is a no-op for the\nadd path because ovpn_peer_add_mp() inserts hash_entry_id before\ncalling ovpn_peer_hash_vpn_ip()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:17.773Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d20c181088984b6eaa8d7fe7cb5ab3510988df59"
},
{
"url": "https://git.kernel.org/stable/c/66745480298775f188b2f5ad266643e85a90f73b"
},
{
"url": "https://git.kernel.org/stable/c/33ec10567fe14456063daf549fdf1a4f53448e4c"
}
],
"title": "ovpn: skip rehash for peers already removed from by_id",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74727",
"datePublished": "2026-08-22T15:33:17.773Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-22T15:33:17.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74727\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:47.813\",\"lastModified\":\"2026-08-22T16:16:47.813\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\novpn: skip rehash for peers already removed from by_id\\n\\novpn_nl_peer_set_doit() resolves the target peer via\\novpn_peer_get_by_id() before taking ovpn-\u003elock. In the window between\\nthe lookup (which only takes a refcount) and the subsequent\\nspin_lock_bh(\u0026ovpn-\u003elock), a concurrent OVPN_CMD_PEER_DEL, keepalive\\nexpiry, or socket teardown can take ovpn-\u003elock first, run\\novpn_peer_remove() to unhash the peer from all four tables (by_id,\\nby_vpn_addr4/6, by_transp_addr) and release the lock. set_doit then\\nacquires ovpn-\u003elock and calls ovpn_peer_hash_vpn_ip(), which\\nre-inserts the now-removed peer back into the rehashing tables.\\n\\nThe same race affects the float path: ovpn_peer_endpoints_update()\\nholds only a refcount and acquires ovpn-\u003elock very late (after async\\nAEAD decrypt and a netlink notification), then rehashes the peer\\nin the by_transp_addr table.\\n\\nThe resurrected peer becomes reachable again from the RX lookup\\n(ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though\\nuserspace believes it is gone. Once the data-path refcount drops the\\npeer is freed via call_rcu while the hash entries embedded in it\\nremain linked, opening a UAF window.\\n\\nBail out of the rehash when hash_entry_id is unhashed, mirroring\\nthe sentinel already used by ovpn_peer_remove() to detect the\\nalready-removed state. The check is safe under ovpn-\u003elock, which\\nserializes every mutation of hash_entry_id, and is a no-op for the\\nadd path because ovpn_peer_add_mp() inserts hash_entry_id before\\ncalling ovpn_peer_hash_vpn_ip().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ovpn/peer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1d36a36f6d5347360ef9681a05f6166683bafd1d\",\"lessThan\":\"d20c181088984b6eaa8d7fe7cb5ab3510988df59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d36a36f6d5347360ef9681a05f6166683bafd1d\",\"lessThan\":\"66745480298775f188b2f5ad266643e85a90f73b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d36a36f6d5347360ef9681a05f6166683bafd1d\",\"lessThan\":\"33ec10567fe14456063daf549fdf1a4f53448e4c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ovpn/peer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33ec10567fe14456063daf549fdf1a4f53448e4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/66745480298775f188b2f5ad266643e85a90f73b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d20c181088984b6eaa8d7fe7cb5ab3510988df59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…