CVE-2026-68342

In the Linux kernel, the following vulnerability has been resolved:

ovpn: avoid putting unrelated P2P peer on socket release

ovpn_peer_release_p2p() is called when an OVPN UDP socket is being

destroyed. It checks the currently published P2P peer and releases it only

if that peer still uses the socket being destroyed.

A peer replacement can publish a new peer before the old UDP socket is

destroyed. When the old socket destruction path runs afterwards,

ovpn_peer_release_p2p() observes the new peer through ovpn->peer. Since the

new peer uses a different socket, the function takes the socket mismatch

branch.

That branch still calls ovpn_peer_put(peer). At this point, however, peer

is the currently published replacement peer, not the peer associated with

the socket being destroyed. Dropping its reference can free it while

ovpn->peer still points to it, leading to later use-after-free accesses

from the peer and socket cleanup paths.

KASAN reports this as a slab-use-after-free on the kmalloc-1k ovpn_peer

object. In the reproducer, the object is allocated from ovpn_peer_new() via

ovpn_nl_peer_new_doit(), and freed through ovpn_peer_release_rcu() from RCU

callback processing. Observed access sites include ovpn_peer_remove(),

ovpn_socket_release(), ovpn_nl_peer_del_notify(), and unlock_ovpn().

Fix this by returning from the socket mismatch branch without putting the

peer.