{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\novpn: tcp – fix packet extraction from stream\\n\\nWhen processing TCP stream data in ovpn_tcp_recv, we receive large\\ncloned skbs from __strp_rcv that may contain multiple coalesced packets.\\nThe current implementation has two bugs:\\n\\n1. Header offset overflow: Using pskb_pull with large offsets on\\n coalesced skbs causes skb-\\u003edata – skb-\\u003ehead to exceed the u16 storage\\n of skb-\\u003enetwork_header. This causes skb_reset_network_header to fail\\n on the inner decapsulated packet, resulting in packet drops.\\n\\n2. Unaligned protocol headers: Extracting packets from arbitrary\\n positions within the coalesced TCP stream provides no alignment\\n guarantees for the packet data causing performance penalties on\\n architectures without efficient unaligned access. Additionally,\\n openvpn’s 2-byte length prefix on TCP packets causes the subsequent\\n 4-byte opcode and packet ID fields to be inherently misaligned.\\n\\nFix both issues by allocating a new skb for each openvpn packet and\\nusing skb_copy_bits to extract only the packet content into the new\\nbuffer, skipping the 2-byte length prefix. Also, check the length before\\ninvoking the function that performs the allocation to avoid creating an\\ninvalid skb.\\n\\nIf the packet has to be forwarded to userspace the 2-byte prefix can be\\npushed to the head safely, without misalignment.\\n\\nAs a side effect, this approach also avoids the expensive linearization\\nthat pskb_pull triggers on cloned skbs with page fragments. In testing,\\nthis resulted in TCP throughput improvements of up to 74%.”,”published”:”2026-05-06T11:28:43.871Z”,”modified”:”2026-05-08T12:41:37.366Z”,”type”:”cve”,”title”:”ovpn: tcp – fix packet extraction from stream”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/0315bec883c67fa1413c61e504a28dc5bd02eb37\\nhttps:\/\/git.kernel.org\/stable\/c\/7dba6cd7fb168d7615194a631c9c100c1c224131\\nhttps:\/\/git.kernel.org\/stable\/c\/d4f687fbbce45b5e88438e89b5e26c0c15847992″,”id”:”CVE-2026-43254″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 11851cbd60ea1e5abbd97619d69845ead99303d6\\nLinux Linux 11851cbd60ea1e5abbd97619d69845ead99303d6\\nLinux Linux 11851cbd60ea1e5abbd97619d69845ead99303d6\\nLinux Linux 6.16″,”sourceHref”:””,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”11851cbd60ea1e5abbd97619d69845ead99303d6″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\novpn: tcp – fix packet extraction from stream\\n\\nWhen processing TCP stream data in ovpn_tcp_recv, we receive…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,16,12,15,13,7,11,5],"class_list":["post-52440","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n