CVE-2026-74727

A flaw was found in the Linux kernel's ovpn module. A race condition can occur when an OpenVPN (ovpn) peer is removed concurrently while the system attempts to rehash it. This can lead to the peer being re-inserted into internal tables after it has been logically removed, creating a Use-After-Free (UAF) vulnerability. This flaw could allow an attacker to cause a denial of service or potentially execute arbitrary code.

A moderate-severity use-after-free flaw was found in the Linux kernel's ovpn (OpenVPN kernel module) driver. When a peer is resolved by ovpn_peer_get_by_id() or handled on the float path in ovpn_peer_endpoints_update() while only a reference count is held, a concurrent peer deletion (OVPN_CMD_PEER_DEL), keepalive expiry, or socket teardown can take ovpn->lock first and remove the peer from all internal hash tables; the subsequent rehash can then re-insert the already-removed peer, leaving hash entries linked after the peer is freed and opening a use-after-free window. An attacker able to trigger this race could cause a denial of service or, potentially, execute arbitrary code. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering the race requires local access with privileges to perform peer-management operations and the practical impact is a loss of system availability. This differs significantly from the upstream CVE record's Critical rating of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes an unauthenticated network vector with full confidentiality and integrity impact. The ovpn module was introduced in upstream kernel version 6.16, and the vulnerable code is not present in the Red Hat Enterprise Linux 6, 7, 8, 9, and 10 kernels or the Red Hat In-Vehicle OS kernels covered by this flaw, so all Red Hat products listed here are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.