Skip to main content

Linux Kernel EUVDEUVD-2026-32213

| CVE-2026-45929 HIGH
Use After Free (CWE-416)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-54qr-3h8v-g6xr
Linux Information Disclosure Memory Corruption Use After Free
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 30, 2026 - 11:28 vuln.today
CVSS changed
May 30, 2026 - 11:22 NVD
7.8 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ovpn: fix possible use-after-free in ovpn_net_xmit

When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations:

  • peer lookup,
  • skb_dst_drop (even though all segments produced by skb_gso_segment

will have a dst attached),

  • ovpn_peer_stats_increment_tx.

Fix this by moving the peer lookup and skb_dst_drop before segmentation so that the original skb is still valid when used. Return early if all segments fail skb_share_check and the list ends up empty. Also switch ovpn_peer_stats_increment_tx to use skb_list.next; the next patch fixes the stats logic.

AnalysisAI

Use-after-free in the Linux kernel's OpenVPN data channel offload (ovpn) module allows a local attacker with low privileges to potentially trigger memory corruption when transmitting shared sk_buff packets through ovpn_net_xmit. The flaw stems from continued use of a stale skb pointer after skb_share_check frees the original buffer, affecting peer lookup, skb_dst_drop, and TX statistics paths. No public exploit identified at time of analysis, and the EPSS probability is very low (0.02%), suggesting the bug is more of a stability and memory-safety concern than an imminently weaponized vector.

Technical ContextAI

The bug lives in drivers/net/ovpn, the in-kernel OpenVPN data-channel offload introduced in Linux 6.16, which terminates OpenVPN tunnels in kernel space for performance. In ovpn_net_xmit, skb_share_check() may free the originally passed sk_buff when it is shared and return a new one for the list; the original code path continued referencing the freed pointer for peer lookup, skb_dst_drop (despite skb_gso_segment producing segments that already carry their own dst), and ovpn_peer_stats_increment_tx. This is a classic use-after-free pattern (CWE-416 class, though CWE is reported as N/A in the input). The upstream fix reorders peer lookup and skb_dst_drop to occur before segmentation, returns early when all segments fail skb_share_check leaving the list empty, and switches the stats increment to use skb_list.next.

RemediationAI

Upgrade to a vendor-released patched kernel: 6.18.14, 6.19.4, or 7.0 per the EUVD-listed fix versions, or apply the upstream commits 3e4fbcb4e078915367ba5576cd70d76dbc970f95, 442915c96a9bff1c7080e2aedabb1c03faa28d81, and a5ec7baa44ea3a1d6aa0ca31c0ad82edf9affe41 from git.kernel.org/stable. Distribution users should pull the corresponding backported kernel package from their vendor (RHEL, Ubuntu, SUSE, Debian) once available. As a compensating control until patching, unload or blacklist the ovpn kernel module on hosts that do not require OpenVPN data channel offload (echo 'blacklist ovpn' into /etc/modprobe.d/) - the trade-off is loss of in-kernel OpenVPN acceleration, forcing fallback to the userspace OpenVPN daemon which is unaffected by this bug. Where ovpn must remain loaded, restrict which local users can create or operate OpenVPN tunnel interfaces (CAP_NET_ADMIN) to reduce the population of accounts able to reach the vulnerable transmit path.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-32213 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy