CVE-2026-64043 addresses a race condition in the Linux kernel's ovpn interface code. When deleting an existing ovpn interface, a narrow timing window allowed a new peer addition via netlink to take a reference to the netdevice after peers were freed and the device was queued for deregistration. This caused the netdevice to hang, blocking its unregistration. The vulnerability was fixed by moving peer release to ndo_uninit(), after the netdevice is removed from the device list, and by adding a reg_state check in ovpn_peer_add() to prevent adding peers if the device is not registered. The fix also ensures netdev_lock is held to avoid racing state changes.

The vulnerability could cause the ovpn network device to hang and prevent its proper unregistration, potentially leading to resource leaks or instability in the kernel networking subsystem. No known exploits in the wild have been reported.

A fix for this race condition has been implemented in the Linux kernel by modifying the ovpn interface code as described. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the specific fixed versions and update accordingly.