CVE-2026-105390: OpenVPN ovpn-dco-win DOS Vulnerability

CVE-2026-105390 Overview

CVE-2026-105390 is a denial-of-service vulnerability in the OpenVPN ovpn-dco-win Windows kernel driver. The Data Channel Offload (DCO) driver fails to properly synchronize access to shared resources. A local attacker can send a crafted write to the ovpn-dco device to trigger a deadlock. The resulting lock contention renders the host unresponsive and requires a hard reboot to recover.

The flaw is tracked under CWE-413: Improper Resource Locking and affects ovpn-dco-win versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7. OpenVPN disclosed the issue through its OpenVPN Security Announcement CVE-2026-105390.

Critical Impact
A local user can freeze a Windows host running vulnerable ovpn-dco-win drivers by issuing a single crafted write to the kernel device object.

Affected Products

OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5
OpenVPN ovpn-dco-win for Windows versions 2.4.0 through 2.8.7
Windows hosts using OpenVPN clients that ship the vulnerable DCO driver

Discovery Timeline

2026-10-13 - CVE-2026-105390 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-105390

Vulnerability Analysis

The ovpn-dco-win driver implements Data Channel Offload for OpenVPN on Windows. It processes encrypted tunnel traffic in kernel mode to reduce user-mode context switches. The driver exposes a device object that user-mode components use to configure peers, keys, and tunnel state.

The vulnerability resides in how the driver acquires and releases synchronization primitives when servicing write requests. A specifically ordered write to the ovpn-dco device causes two code paths to request locks in incompatible orders. This produces a classic deadlock condition in which neither path can proceed. Because the involved locks protect driver-wide state, subsequent I/O to the device also blocks indefinitely. Kernel worker threads waiting on the same resources stall, and the host loses network and interactive responsiveness.

Root Cause

The root cause is improper resource locking inside the kernel driver, categorized as CWE-413. The driver does not enforce a consistent lock-acquisition order or use a single arbitration primitive for the affected code paths. An attacker who controls the content and timing of writes to the device object can deterministically induce the lock-order inversion.

Attack Vector

Exploitation requires local access to the Windows host and the ability to open a handle to the ovpn-dco device. No authentication to OpenVPN itself is required beyond standard device-access permissions. The attacker sends a crafted I/O request to the device, which triggers the deadlock inside the kernel driver. The result is a host-wide hang affecting availability but not confidentiality or integrity. OpenVPN provides technical details in its security advisory.

No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-105390

Indicators of Compromise

Windows hosts becoming unresponsive shortly after a local process opens a handle to the \\.\ovpn-dco device
System event logs showing stalled kernel worker threads tied to ovpn-dco-win.sys
Hard reboots required to restore network connectivity on hosts running OpenVPN with DCO enabled

Detection Strategies

Inventory Windows endpoints to identify installations of ovpn-dco-win.sys at versions in the 0.6.5–1.3.5 or 2.4.0–2.8.7 ranges
Alert on unexpected processes opening handles to the ovpn-dco device, especially from non-OpenVPN binaries
Correlate sudden host unresponsiveness with recent DeviceIoControl or WriteFile activity targeting the OpenVPN DCO driver

Monitoring Recommendations

Collect Windows kernel crash and hang dumps for forensic review when hosts recover from an unresponsive state
Monitor driver file hashes and versions through endpoint telemetry to detect vulnerable ovpn-dco-win.sys builds
Track OpenVPN client version distribution across the fleet and flag deployments that have not received the fixed release

How to Mitigate CVE-2026-105390

Immediate Actions Required

Identify all Windows systems running OpenVPN clients that install ovpn-dco-win within the affected version ranges
Upgrade ovpn-dco-win to a fixed release beyond 1.3.5 or 2.8.7 as published in the OpenVPN security advisory
Restrict local logon rights on sensitive hosts to limit which users can issue writes to the DCO device

Patch Information

OpenVPN has published fixed versions of ovpn-dco-win in the OpenVPN Security Announcement CVE-2026-105390. Administrators should deploy the updated OpenVPN Windows client packages that bundle the corrected driver. Validate the driver version through the Windows device manager or by inspecting the file properties of ovpn-dco-win.sys after installation.

Workarounds

Disable Data Channel Offload in the OpenVPN client configuration to fall back to the non-DCO data path until patching is complete
Uninstall the ovpn-dco-win driver on hosts that do not require DCO performance benefits
Apply standard Windows least-privilege controls to prevent untrusted local users from interacting with the OpenVPN device object

bash

# Verify ovpn-dco-win driver version on a Windows host
Get-WmiObject Win32_SystemDriver | Where-Object { $_.Name -eq 'ovpn-dco-win' }
Get-Item 'C:\\Windows\\System32\\drivers\\ovpn-dco-win.sys' | Select-Object VersionInfo