Vulnerability Details CVE-2026-45929
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix possible use-after-free in ovpn_net_xmit
When building the skb_list in ovpn_net_xmit, skb_share_check will free
the original skb if it is shared. The current implementation continues
to use the stale skb pointer for subsequent operations:
- peer lookup,
- skb_dst_drop (even though all segments produced by skb_gso_segment
will have a dst attached),
- ovpn_peer_stats_increment_tx.
Fix this by moving the peer lookup and skb_dst_drop before segmentation
so that the original skb is still valid when used. Return early if all
segments fail skb_share_check and the list ends up empty.
Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next
patch fixes the stats logic.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 5.2%
CVSS Severity
CVSS v3 Score 7.8
References
Products affected by CVE-2026-45929
-
cpe:2.3:o:linux:linux_kernel:6.16
-
cpe:2.3:o:linux:linux_kernel:6.16.1
-
cpe:2.3:o:linux:linux_kernel:6.16.10
-
cpe:2.3:o:linux:linux_kernel:6.16.11
-
cpe:2.3:o:linux:linux_kernel:6.16.12
-
cpe:2.3:o:linux:linux_kernel:6.16.2
-
cpe:2.3:o:linux:linux_kernel:6.16.3
-
cpe:2.3:o:linux:linux_kernel:6.16.4
-
cpe:2.3:o:linux:linux_kernel:6.16.5
-
cpe:2.3:o:linux:linux_kernel:6.16.6
-
cpe:2.3:o:linux:linux_kernel:6.16.7
-
cpe:2.3:o:linux:linux_kernel:6.16.8
-
cpe:2.3:o:linux:linux_kernel:6.16.9
-
cpe:2.3:o:linux:linux_kernel:6.17
-
cpe:2.3:o:linux:linux_kernel:6.17.1
-
cpe:2.3:o:linux:linux_kernel:6.17.10
-
cpe:2.3:o:linux:linux_kernel:6.17.11
-
cpe:2.3:o:linux:linux_kernel:6.17.12
-
cpe:2.3:o:linux:linux_kernel:6.17.13
-
cpe:2.3:o:linux:linux_kernel:6.17.2
-
cpe:2.3:o:linux:linux_kernel:6.17.3
-
cpe:2.3:o:linux:linux_kernel:6.17.4
-
cpe:2.3:o:linux:linux_kernel:6.17.5
-
cpe:2.3:o:linux:linux_kernel:6.17.6
-
cpe:2.3:o:linux:linux_kernel:6.17.7
-
cpe:2.3:o:linux:linux_kernel:6.17.8
-
cpe:2.3:o:linux:linux_kernel:6.17.9
-
cpe:2.3:o:linux:linux_kernel:6.18
-
cpe:2.3:o:linux:linux_kernel:6.18.1
-
cpe:2.3:o:linux:linux_kernel:6.18.10
-
cpe:2.3:o:linux:linux_kernel:6.18.11
-
cpe:2.3:o:linux:linux_kernel:6.18.13
-
cpe:2.3:o:linux:linux_kernel:6.18.2
-
cpe:2.3:o:linux:linux_kernel:6.18.3
-
cpe:2.3:o:linux:linux_kernel:6.18.4
-
cpe:2.3:o:linux:linux_kernel:6.18.5
-
cpe:2.3:o:linux:linux_kernel:6.18.6
-
cpe:2.3:o:linux:linux_kernel:6.18.7
-
cpe:2.3:o:linux:linux_kernel:6.18.8
-
cpe:2.3:o:linux:linux_kernel:6.18.9
-
cpe:2.3:o:linux:linux_kernel:6.19
-
cpe:2.3:o:linux:linux_kernel:6.19.1
-
cpe:2.3:o:linux:linux_kernel:6.19.3