Your message dated Sun, 19 Jul 2026 00:02:43 +0000
with message-id <[email protected]>
and subject line Bug#1140548: fixed in openvpn-dco-dkms
0.0+git20241121-1+deb13u1
has caused the Debian Bug report #1140548,
regarding openvpn-dco-dkms: ovpn_dco_v2 use-after-free (NULL deref in
ovpn_netlink_notify_del_peer) crashes under peer-deletion storm
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140548: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140548
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: openvpn-dco-dkms
Version: 0.0+git20241121-1
Severity: important
Tags: upstream fixed-upstream
X-Debbugs-Cc:
Dear Maintainer,
The ovpn_dco_v2 module built from the snapshot in trixie/stable
(0.0+git20241121-1) contains a use-after-free in the peer-deletion path
that causes a kernel NULL-pointer dereference under high client
connect/disconnect concurrency. It is fixed upstream (commit f74c59a7,
2026-05-14) but the fix is not present in any released Debian version.
== The defect ==
In drivers/net/ovpn-dco/peer.c, ovpn_peer_delete_work() releases the peer
*before* using it:
static void ovpn_peer_delete_work(struct work_struct *work)
{
struct ovpn_peer *peer = container_of(work, struct ovpn_peer,
delete_work);
ovpn_peer_release(peer); /* arms call_rcu() ->
frees peer */
ovpn_netlink_notify_del_peer(peer); /* then derefs
peer->ovpn->dev */
}
ovpn_peer_release() ends in call_rcu(&peer->rcu, ovpn_peer_release_rcu),
whose callback (ovpn_peer_release_rcu -> ovpn_peer_free) does
dev_put(peer->ovpn->dev) and kfree(peer). Because ovpn_peer_delete_work()
is not in an RCU read-side critical section, that callback can run (on any
CPU) before ovpn_netlink_notify_del_peer() executes. That function then
dereferences peer->ovpn->dev (netdev_info(), nla_put_u32(... ifindex ...),
genlmsg_multicast_netns(dev_net(...))) through freed memory.
In steady state the RCU grace period is long relative to the function, so
the free happens later and nothing is observed. Under a mass simultaneous
reconnect (hundreds of peers deleted/recreated at once on a multi-core
host), grace periods complete in milliseconds and the free races ahead of
the notification -> NULL-pointer dereference.
== Observed crash ==
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: ovpn_netlink_notify_del_peer+0xa8 [ovpn_dco_v2]
Workqueue: ovpn-event-wq-<dev> ovpn_peer_delete_work [ovpn_dco_v2]
CR2: 0000000000000000 RAX: 0000000000000000
After the first oops the module's peer table is corrupted: subsequent peer
deletions oops repeatedly, the tun interface loses its address, and the
module reaches a state where rmmod -f fails ("Device or resource busy",
refcount underflow). A full reboot does not help if clients immediately
reconnect (the oops loop resumes within minutes); the only recovery is to
disable DCO (disable-dco in the OpenVPN server config) so peer operations
go through userspace instead of the kernel module.
== Environment ==
Debian 13 (trixie), kernel 6.12.x-cloud-amd64
openvpn 2.6.14-1+deb13u2
openvpn-dco-dkms 0.0+git20241121-1
Multi-vCPU host, OpenVPN UDP server with several hundred clients;
triggered by a mass simultaneous client reconnect.
== Fix ==
Fixed upstream in OpenVPN/ovpn-dco by commit f74c59a7
("ovpn-dco: avoid UAF when releasing peer", 2026-05-14):
https://github.com/OpenVPN/ovpn-dco/commit/f74c59a7e2c8b63958f556df74a585d54e2ac660
which simply reorders the two calls so the notification runs while the peer
is still valid:
ovpn_netlink_notify_del_peer(peer); /* notify first */
ovpn_peer_release(peer); /* then schedule the free */
A companion commit addresses a related NAPI add/delete race
("ovpn-dco: serialize peer NAPI add/delete", 2026-05-14):
https://github.com/OpenVPN/ovpn-dco/commit/ef379eae8534a7bc4847d8545573b00c5f4887ae
Neither is in any released Debian version: trixie/stable ships
0.0+git20241121-1 and testing/unstable ship 0.0+git20251017-1, both of
which predate the May-2026 fix.
== Request ==
Please update openvpn-dco-dkms to an upstream snapshot that includes
f74c59a7 (and ideally ef379eae). The primary fix is a two-line reorder and
is trivially cherry-pickable as a patch if a full snapshot bump is not
desired for stable.
Note: OpenVPN/ovpn-dco is upstream in bugfix-only/maintenance mode (it
supports OpenVPN 2.6.x). For OpenVPN 2.7+ the replacement is the in-tree
"ovpn" module (Linux 6.16+) / the OpenVPN/ovpn-backports project; this
report concerns the 2.6.x ovpn-dco module shipped in trixie.
Thank you.
Thomas
--- End Message ---
--- Begin Message ---
Source: openvpn-dco-dkms
Source-Version: 0.0+git20241121-1+deb13u1
Done: Bernhard Schmidt <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openvpn-dco-dkms, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bernhard Schmidt <[email protected]> (supplier of updated openvpn-dco-dkms
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 23 Jun 2026 23:58:52 +0200
Source: openvpn-dco-dkms
Architecture: source
Version: 0.0+git20241121-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Bernhard Schmidt <[email protected]>
Changed-By: Bernhard Schmidt <[email protected]>
Closes: 1140548
Changes:
openvpn-dco-dkms (0.0+git20241121-1+deb13u1) trixie; urgency=medium
.
* Add debian/gbp.conf for debian/trixie branch
* Cherry-Pick upstream patches to fix NULL deref in
ovpn_netlink_notify_del_peer
(Closes: #1140548)
Checksums-Sha1:
717f4e0ec4bfcb1c510bb70ece7526ae3d14ad8a 2085
openvpn-dco-dkms_0.0+git20241121-1+deb13u1.dsc
f6129210a09904b111d496ab23a4d3159a1fbacb 5128
openvpn-dco-dkms_0.0+git20241121-1+deb13u1.debian.tar.xz
284bb2f7f939359c8866d545e1782a07f4b5f53f 5994
openvpn-dco-dkms_0.0+git20241121-1+deb13u1_amd64.buildinfo
Checksums-Sha256:
59816302df2c47813c96790ce4069351f32fb2ec5a575d675a7d545c8b8a3eb7 2085
openvpn-dco-dkms_0.0+git20241121-1+deb13u1.dsc
fd2f8705e8912e86f74856929464fab9c8d404412ef8ee1547e3d6cdaf12cc60 5128
openvpn-dco-dkms_0.0+git20241121-1+deb13u1.debian.tar.xz
f12ab394ed328e93ebfe392a273370350445adb606ce16d5491f64ab393e92c0 5994
openvpn-dco-dkms_0.0+git20241121-1+deb13u1_amd64.buildinfo
Files:
84a8056b154623eb90946289d04dad26 2085 net optional
openvpn-dco-dkms_0.0+git20241121-1+deb13u1.dsc
7781af0ff7b42ab04256fc5baa0e4efd 5128 net optional
openvpn-dco-dkms_0.0+git20241121-1+deb13u1.debian.tar.xz
45f747bfac10d834b1b5e41b1bd42793 5994 net optional
openvpn-dco-dkms_0.0+git20241121-1+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmpbodYRHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJPHUg//bQ+Bw4a9wJSMeEACnGMl8fsoNeh5EqzU
++LmhHx1/Av63VkDBE5yuTh3TLi2IpyknxbP8U4oxIqVxQnRZaj4/wjzhnOBNtcf
7anNy7EMWa28F2Wa3GVLqLd5bw7LHvRV+RN7XDcFPL9HpJD18BF8EsZkqLULhe6j
fwsoIL9N1iyv8fKPIF6pL9hSdRfPLNTn8SkIAcvdGOD1hYeGQeGHyJ2MdbD/LAi3
qPG7ZruNskGaBpSrisUHFHf7OVcSTuGmfjDXtJggmWrW764W6eZ6b1ZgFuxmJSL0
6xnJyAHiFRx3U5fnZNfJdl8hasvNy6W/rUA0B15zpRXeh58P8+6TsR1qjZIH8ANA
U5gbJuKvQ/EEycAk2Vkq2ShqolDcOUaH8QUu02bs50eBfKlOuHyIbuyDpcyjH0vV
2qhPpJXytJTmPtxqxSM3F8pKnK+HnSmrWIjk/RGsPFMiz5IwAgJ3vwZ0n0acD+s8
2Dn0oWcTV0iYtWTTfOtje2QV49BBMZOl3t1zqJ6f81gKwJZ+5V8mTiJj93C5v37b
yzFFv3fjNjDSGvOmKRqvR8rNgHVwN5cs89Qxod1hIHuwaPZibrfVF9B0IyYOsNm2
qoQJyhXBLOrUvuJGpeGHUirzfNC+NIKj3KCd6Brl28OVifi09ADZItDvwW7cTTof
uV9C+j3PK5Y=
=lhTw
-----END PGP SIGNATURE-----
pgp62RWhcrf55.pgp
Description: PGP signature
--- End Message ---
