[meta-networking][wrynose][PATCH] openvpn: fix CVE-2026-13117

An Incomplete guard in OpenVPN allows remote authenticated
peers to trigger a use-after-free during TLS session promotion,
potentially leading to a denial of service or memory leakage

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2026-13117]
[https://security-tracker.debian.org/tracker/CVE-2026-13117]

Upstream patch:
[https://github.com/OpenVPN/openvpn/commit/3ce0242e68527fd1e8d378aecb57c466e8058b44]

Signed-off-by: Omkar Patil <[email protected]>
---
 .../openvpn/openvpn/CVE-2026-13117.patch      | 46 +++++++++++++++++++
 .../recipes-support/openvpn/openvpn_2.7.0.bb  |  1 +
 2 files changed, 47 insertions(+)
 create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch

diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch
new file mode 100644
index 0000000000..ea2e32bdcb
--- /dev/null
+++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch
@@ -0,0 +1,46 @@
+From 3ce0242e68527fd1e8d378aecb57c466e8058b44 Mon Sep 17 00:00:00 2001
+From: Max Fillinger <[email protected]>
+Date: Fri, 22 May 2026 14:34:57 +0200
+Subject: [PATCH] Fix tls_wrap_reneg use after free
+
+When dynamic tls-crypt is active, it is possible for tls_multi_process
+to set to_link to session->tls_wrap_reneg.work and later free that
+session, leaving to_link.data pointing to freed memory.
+
+This is not caught by the function check_session_buf_not_used because it
+checks only tls_wrap, not tls_wrap_reneg. This commit adds that check.
+
+CVE: 2026-13117
+Github: OpenVPN/openvpn-private-issues#119
+Github: OpenVPN/openvpn-private-issues#125
+Reported-By: Trace37 Labs (https://github.com/trace37labs)
+Github: OpenVPN/openvpn-private-issues#131
+Reported-By: Haiyang Huang <[email protected]>
+Signed-off-by: Max Fillinger <[email protected]>
+Acked-By: Arne Schwabe <[email protected]>
+(cherry picked from commit 2745768d6181c1d54ebfc5ef81f924a127f4f015)
+
+CVE: CVE-2026-13117
+Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/3ce0242e68527fd1e8d378aecb57c466e8058b44]
+Signed-off-by: Omkar Patil <[email protected]>
+---
+ src/openvpn/ssl.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
+index c0ab6d3dfbe..d7e93bd41ab 100644
+--- a/src/openvpn/ssl.c
++++ b/src/openvpn/ssl.c
+@@ -3154,6 +3154,12 @@ check_session_buf_not_used(struct buffer *to_link, struct tls_session *session)
+                     "still in use (tls_wrap.work.data)");
+         goto used;
+     }
++    if (session->tls_wrap_reneg.work.data == dataptr)
++    {
++        msg(M_INFO, "Warning buffer of freed TLS session is "
++                    "still in use (tls_wrap_reneg.work.data)");
++        goto used;
++    }
+ 
+     for (int i = 0; i < KS_SIZE; i++)
+     {
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb
index 4e466598dc..4d7258bfe8 100644
--- a/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb
+++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb
@@ -13,6 +13,7 @@ SRC_URI = "http://swupdate.openvpn.org/community/releases/${BP}.tar.gz \
            file://openvpn \
            file://run-ptest \
            file://CVE-2026-40215.patch \
+           file://CVE-2026-13117.patch \
           "
 
 UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"
-- 
2.40.0