CVE-2026-68122

A flaw was found in the Linux kernel's ovpn module. A race condition in the TCP error handling paths can lead to a reference count leak. This occurs when an internal object's reference count is incremented twice but decremented only once, preventing the object from being properly released. Over time, this resource exhaustion could lead to a Denial of Service (DoS) condition.

This issue affects OpenVPN kernel (ovpn) TCP mode. Concurrent RX/TX error paths can schedule defer_del_work only once while holding two peer references, leaking refcounts. Systems not using ovpn are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.