In the Linux kernel, the following vulnerability has been resolved: ovpn: fix race between deleting interface and adding new peer While deleting an… (CVE-2026-64043)

CVE-2026-64043 describes a race condition in the Linux kernel's ovpn interface management. When an ovpn interface is deleted, if a new peer is added concurrently, the network device can hang and fail to unregister properly. The vulnerability was addressed by modifying the kernel to release all peers during netdevice uninitialization and adding a check to prevent adding peers if the device is not registered, thus preventing the race condition.

The vulnerability impacts availability by causing the network device to hang and preventing its unregistration. There is no impact on confidentiality or integrity. The CVSS score of 4.7 reflects a medium severity with local attack vector, high attack complexity, low privileges required, no user interaction, and unchanged scope.

A fix has been implemented in the Linux kernel to address this race condition by releasing all peers during netdevice uninitialization and preventing peer addition if the device is unregistered. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.