CVE-2026-64043: Linux Kernel Race Condition Vulnerability

CVE-2026-64043 Overview

CVE-2026-64043 is a race condition vulnerability in the Linux kernel's OpenVPN Data Channel Offload (ovpn) module. The flaw exists between the interface deletion path and the peer addition path exposed through netlink. When the ovpn_dellink() routine releases existing peers and queues the netdevice for deregistration, an incoming CMD_PEER_NEW netlink message can add a new peer that acquires a fresh reference to the netdev. The netdevice then hangs and cannot be unregistered because the kernel assumed all peers had already been released.

Critical Impact
A local user with netlink access can trigger a netdevice unregistration hang by racing peer creation against ovpn interface deletion, resulting in a stuck kernel resource.

Affected Products

Linux kernel builds shipping the ovpn (OpenVPN Data Channel Offload) module prior to the fix
Stable kernel branches referenced by the upstream commits 097d62df3831, 982422b11e6f, and de9fec2a6645
Distribution kernels that backported the ovpn netlink peer management code without the race fix

Discovery Timeline

2026-07-19 - CVE-2026-64043 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64043

Vulnerability Analysis

The defect is a race condition [CWE-362] in the ovpn netlink control plane. The ovpn_dellink() function tears down an existing ovpn interface by releasing all peers and queueing the netdevice for deregistration. During a narrow window between peer teardown and final unregistration, a concurrent CMD_PEER_NEW netlink message can invoke ovpn_peer_add() and take a new reference on the netdev. Because the deregistration path assumes zero remaining peers, the newly added peer holds a reference that no cleanup routine will drop, and the netdevice stalls indefinitely.

The fix relocates peer teardown into ndo_uninit(), which runs after the netdevice has been removed from the netdev list. ovpn_peer_add() also now inspects the netdev reg_state while holding netdev_lock and bails out when the state is not REGISTERED. The empty ovpn_dellink() is removed. The epssScore for CVE-2026-64043 is 0.198%.

Root Cause

The root cause is missing synchronization between the interface deletion routine and netlink peer creation. ovpn_dellink() released peers and queued deregistration without preventing new peers from being added during the interim, and ovpn_peer_add() did not validate the netdev registration state before acquiring a reference.

Attack Vector

Exploitation requires local access with permission to send netlink messages to the ovpn family. A caller repeatedly triggers ovpn interface deletion while a second caller issues CMD_PEER_NEW messages against the same interface. Successfully racing the two operations leaves the netdev in a hung state, resulting in a denial of service against kernel networking resources. Remote exploitation is not applicable because the trigger requires local netlink access.

No verified public proof-of-concept code is available. See the upstream commits 097d62df3831, 982422b11e6f, and de9fec2a6645 for the fix details.

Detection Methods for CVE-2026-64043

Indicators of Compromise

Kernel log warnings referencing unregister_netdevice: waiting for <ifname> to become free associated with ovpn interfaces
Stuck ovpn netdevices that resist ip link delete and remain visible in /sys/class/net/ after deletion attempts
Workqueue backlog on the netdev cleanup path with references to the ovpn module

Detection Strategies

Audit AUDIT_NETLINK records for high-frequency CMD_PEER_NEW messages issued against ovpn interfaces that are also being deleted
Correlate RTM_DELLINK events on ovpn devices with subsequent ovpn netlink family commands from unprivileged or unexpected processes
Monitor kernel ring buffer output through dmesg or journalctl -k for repeated unregister-waiting messages tied to ovpn

Monitoring Recommendations

Track running kernel versions across Linux fleets and flag hosts on ovpn-enabled kernels that have not received the fix commits
Alert on processes invoking iproute2 or custom netlink clients that combine link delete and ovpn peer commands in rapid succession
Watch for network interface counts that fail to decrease after deletion, which indicates hung netdevices

How to Mitigate CVE-2026-64043

Immediate Actions Required

Update Linux kernels to a stable release that includes commits 097d62df3831, 982422b11e6f, and de9fec2a6645
Restrict access to the ovpn netlink family to trusted administrators by tightening CAP_NET_ADMIN assignments and namespace boundaries
Inventory hosts using the in-kernel ovpn Data Channel Offload and prioritize patching those systems

Patch Information

The upstream fix moves peer release into ndo_uninit() and adds a reg_state != REGISTERED guard in ovpn_peer_add() under netdev_lock. Apply the vendor kernel update that incorporates the three referenced stable commits, then reboot to load the corrected module. See git.kernel.org commit 097d62df3831 for the mainline change.

Workarounds

Disable or unload the ovpn kernel module on hosts where OpenVPN Data Channel Offload is not required
Serialize administrative operations so that ovpn interface deletion cannot overlap with peer creation on the same interface
Constrain unprivileged user namespaces that could grant CAP_NET_ADMIN inside a namespace hosting ovpn devices

bash

# Verify whether the ovpn module is loaded and unload it if unused
lsmod | grep '^ovpn'
sudo modprobe -r ovpn

# Prevent automatic loading until the kernel is patched
echo 'blacklist ovpn' | sudo tee /etc/modprobe.d/disable-ovpn.conf