CVE-2026-68122: Linux Kernel Race Condition Vulnerability

CVE-2026-68122 Overview

CVE-2026-68122 is a memory leak vulnerability in the Linux kernel's OpenVPN (ovpn) module. The flaw exists in the TCP error handling paths, where concurrent receive (RX) and transmit (TX) error conditions can leak a peer object reference. When both paths attempt to schedule the same deferred deletion work item, the second schedule_work() call returns false, but the extra reference taken by ovpn_peer_hold() is never released. The peer object is never freed, resulting in a kernel memory leak.

Critical Impact
Repeated triggering of the race condition can exhaust kernel memory, degrading system stability and potentially enabling denial-of-service conditions on Linux systems running the affected ovpn kernel module.

Affected Products

Linux kernel with the ovpn (OpenVPN in-kernel) module enabled
Distributions shipping vulnerable pre-patch kernel versions
Systems using in-kernel OpenVPN TCP transport

Discovery Timeline

2026-08-10 - CVE-2026-68122 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68122

Vulnerability Analysis

The vulnerability resides in the ovpn kernel module's TCP transport error handling. Both the RX error path (strparser) and TX error path (tcp_tx_work) call ovpn_peer_hold() to acquire an extra reference on the peer object before scheduling ovpn_tcp_peer_del_work via schedule_work(&peer->tcp.defer_del_work).

The issue arises because schedule_work() returns false if the work item is already pending. When this occurs, the deferred deletion work runs only once, and ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once. The extra reference taken by the losing path is never dropped, permanently pinning the peer object in kernel memory.

Root Cause

The root cause is a race condition [CWE-362] between concurrent references to the same work item. The code assumed that every ovpn_peer_hold() call would be matched by a corresponding ovpn_peer_put() invoked by the deferred worker. This assumption breaks when both error paths execute concurrently on separate CPUs and the work item is already queued from the first invocation.

Attack Vector

An attacker able to trigger repeated TCP errors on OpenVPN peer connections can exercise the race window between the RX and TX error handlers. Each successful race leaks one peer structure and its associated references. Sustained triggering leads to gradual memory exhaustion on the affected host.

The upstream fix, referenced in the kernel commit log, checks the return value of schedule_work() in both paths. When the work is already pending, the caller invokes ovpn_peer_put() to release the extra reference immediately.

Detection Methods for CVE-2026-68122

Indicators of Compromise

Gradual growth of unaccounted kernel slab memory on hosts running the ovpn module
Unreleased peer objects visible in kernel debugging interfaces such as kmemleak reports referencing ovpn_peer allocations
Elevated frequency of TCP transport errors correlated with OpenVPN peer sessions

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels to identify leaked ovpn_peer allocations
Monitor /proc/slabinfo for abnormal growth in ovpn-related slab caches over time
Correlate TCP session teardown errors with sustained kernel memory pressure on VPN gateways

Monitoring Recommendations

Track kernel memory utilization trends on hosts terminating OpenVPN TCP tunnels
Alert on unexplained increases in MemAvailable degradation without corresponding userspace consumption
Log kernel warnings and dmesg output for repeated ovpn TCP error events

How to Mitigate CVE-2026-68122

Immediate Actions Required

Identify Linux systems running the ovpn in-kernel OpenVPN module and inventory their kernel versions
Apply the upstream stable kernel patches referenced by the fix commits 63bbe18f, b08526bf, and f08f39c1
Schedule reboots on affected VPN gateways to load the patched kernel

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Apply the vendor-supplied kernel update from your distribution that includes commits 63bbe18fc030, b08526bf0bbf, and f08f39c1f43f. The patch checks the return value of schedule_work() and calls ovpn_peer_put() when the work is already pending.

Workarounds

Where feasible, use UDP transport for OpenVPN peers to avoid the affected TCP error paths
Restrict exposure of OpenVPN TCP listeners to trusted network segments to reduce error-triggering conditions
Reboot affected VPN gateways periodically to reclaim leaked memory until patches are deployed

bash

# Verify running kernel version and check for the ovpn module
uname -r
lsmod | grep ovpn

# After distribution patch is applied, reboot to load the fixed kernel
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot