In the Linux kernel’s OVPN implementation, a race condition exists between the RX and TX error handling paths. When each path calls ovpn_peer_hold() and attempts to schedule work for peer cleanup, the second call to schedule_work() is ignored because the work is already pending. The first path then releases the held reference once the deferred work runs, but the second path never releases its reference. This results in a reference count leak of the peer object and a potential memory leak that can grow unchecked over time.

All Linux kernel builds that include the OVPN networking module default to this vulnerable logic. No specific kernel versions were listed as affected, so the condition applies to every kernel release prior to that containing the 2026-68122 fix.

The described vulnerability could lead to gradual memory consumption and eventual resource exhaustion, which might manifest as a denial‑of‑service at the kernel or system level. The CVSS score is 5.9, and the EPSS score indicates a likelihood of exploitation of less than 1%, thus the threat is considered moderate. The vulnerability is not listed in the CISA KEV catalog, indicating that no public exploitation campaigns have been observed yet. Attacks would require existing OVPN traffic with error conditions; thus the attack vector is likely indirect via malformed or corrupted connections to the OVPN service.