CVE-2026-68342

A flaw was found in the Linux kernel's OpenVPN (ovpn) module. During the destruction of an ovpn UDP socket, a race condition can occur where a new peer is published before the old socket is fully released. This can lead to a use-after-free vulnerability, allowing an attacker to potentially cause a denial of service or execute arbitrary code by manipulating memory that has been deallocated.

This issue affects ovpn UDP P2P mode. Socket release can put unrelated P2P peer. Systems not using ovpn are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.