Linux Kernel CVE-2026-68341

The ovpn module is the in-kernel OpenVPN data channel driver merged into Linux mainline at version 6.16 (introduced via commit 80747caef33d77f5c1b3d24644e6d7dae69066b5). It offloads OpenVPN packet processing from userspace into the kernel for improved throughput, replacing the traditional tun/tap userspace approach. The vulnerable function unlock_ovpn() iterates over a linked list of peers scheduled for release using llist_for_each_entry(). Inside the loop body, ovpn_peer_put() decrements the peer's reference count; when the count reaches zero, the kernel allocator frees the peer structure. The macro llist_for_each_entry() is not iterator-safe: it reads peer->release_entry.next in the loop's advance expression, which executes AFTER the loop body. At that point, the peer struct may already be freed, and reading from freed kernel memory constitutes CWE-416 (Use After Free). Depending on allocator state and kernel mitigations, this can result in a kernel panic, information leakage of kernel memory, or in a worst-case scenario, exploitable memory corruption. The upstream fix replaces llist_for_each_entry() with llist_for_each_entry_safe(), which pre-caches the next pointer before the body executes, making it safe to free the current entry during iteration.