CVE-2026-74727 Overview
CVE-2026-74727 is a race condition in the Linux kernel's ovpn (OpenVPN in-kernel) module that leads to a use-after-free (UAF) condition. The flaw exists in ovpn_nl_peer_set_doit(), which resolves a target peer via ovpn_peer_get_by_id() before acquiring ovpn->lock. Concurrent operations such as OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown can remove the peer between the lookup and the lock acquisition. The subsequent rehash re-inserts the removed peer into hash tables, resurrecting a peer that userspace believes is gone. When the data-path refcount drops, the peer is freed while its hash entries remain linked.
Critical Impact
A network-reachable attacker can trigger a use-after-free in the Linux kernel ovpn module, enabling potential memory corruption and code execution at kernel privilege.
Affected Products
- Linux kernel builds including the in-kernel ovpn OpenVPN data-path module
- Distributions shipping vulnerable pre-patch kernel revisions
- Systems using ovpn netlink peer management operations
Discovery Timeline
- 2026-08-22 - CVE-2026-74727 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74727
Vulnerability Analysis
The defect is a time-of-check to time-of-use (TOCTOU) race in the ovpn netlink peer management path. ovpn_nl_peer_set_doit() calls ovpn_peer_get_by_id(), which only takes a reference count on the peer. It then attempts to acquire ovpn->lock. In the window between the lookup and the spin_lock_bh(&ovpn->lock) call, another thread executing OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown can acquire ovpn->lock first. That thread runs ovpn_peer_remove(), which unhashes the peer from all four tables (by_id, by_vpn_addr4/6, by_transp_addr) and releases the lock.
When set_doit finally acquires ovpn->lock, it calls ovpn_peer_hash_vpn_ip() and re-inserts the removed peer into the rehashing tables. The float path via ovpn_peer_endpoints_update() exhibits the same race: it holds only a refcount and acquires ovpn->lock late, after asynchronous AEAD decryption and a netlink notification, then rehashes the peer in by_transp_addr.
Root Cause
The resurrected peer becomes reachable again from the receive-side lookup ovpn_peer_get_by_transp_addr and the transmit VPN-IP lookup. Once the data-path refcount reaches zero, the peer is freed via call_rcu while embedded hash entries remain linked. This creates a use-after-free window where hash traversal encounters freed memory.
Attack Vector
The race is triggered by interleaving netlink peer management commands with peer teardown events on an active ovpn interface. The vulnerability manifests without user interaction across the network boundary of the VPN. Successful exploitation requires precise timing to hit the window between refcount acquisition and lock acquisition on ovpn->lock. See the kernel git commit d20c181 for the upstream fix details.
The fix bails out of the rehash when hash_entry_id is unhashed, mirroring the sentinel already used by ovpn_peer_remove() to detect the already-removed state. The check is safe under ovpn->lock, which serializes every mutation of hash_entry_id.
Detection Methods for CVE-2026-74727
Indicators of Compromise
- Kernel oops or panic entries referencing ovpn_peer_get_by_transp_addr, ovpn_peer_hash_vpn_ip, or call_rcu in system logs.
- Unexpected KASAN use-after-free reports in dmesg on hosts running the ovpn module.
- Bursts of OVPN_CMD_PEER_DEL netlink activity concurrent with OVPN_CMD_PEER_SET operations from unprivileged or unexpected sources.
Detection Strategies
- Monitor dmesg and /var/log/kern.log for stack traces originating in the ovpn module or netlink peer handlers.
- Enable KASAN on test kernels to surface UAF conditions during fuzzing of the ovpn netlink interface.
- Alert on kernel version fingerprints reporting ovpn module builds prior to the fix commits 33ec105, 6674548, and d20c181.
Monitoring Recommendations
- Track netlink socket usage against the OVPN generic netlink family for anomalous command sequences.
- Correlate VPN session churn with kernel warnings using centralized log aggregation.
- Baseline peer add/remove rates on production VPN concentrators and alert on statistical outliers.
How to Mitigate CVE-2026-74727
Immediate Actions Required
- Upgrade to a Linux kernel release containing the fix commits 33ec105, 6674548, or d20c181 from the stable tree.
- Restrict access to the OVPN generic netlink family so that only trusted service accounts can issue peer management commands.
- Audit workloads that expose the ovpn interface to untrusted tenants and apply strict capability boundaries.
Patch Information
The upstream fix modifies ovpn_peer_hash_vpn_ip() to bail out when hash_entry_id is unhashed, matching the sentinel semantics already enforced by ovpn_peer_remove(). See the patches at kernel git commit 33ec105, kernel git commit 6674548, and kernel git commit d20c181. Distribution vendors will backport these commits to supported long-term stable kernel branches.
Workarounds
- Unload the ovpn kernel module on hosts that do not require in-kernel OpenVPN acceleration until patches are applied.
- Fall back to userspace OpenVPN implementations that do not depend on the in-kernel data path.
- Constrain CAP_NET_ADMIN allocation in containerized environments to prevent unprivileged workloads from invoking ovpn netlink commands.
# Verify kernel version and unload the ovpn module if unpatched
uname -r
lsmod | grep ovpn
sudo modprobe -r ovpn
echo "blacklist ovpn" | sudo tee /etc/modprobe.d/ovpn-blacklist.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
