CVE-2026-80519 (GCVE-0-2026-80519)
Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
EPSS
VEX
Title
ovpn: finish crypto callback cleanup before peer release
Summary
In the Linux kernel, the following vulnerability has been resolved:
ovpn: finish crypto callback cleanup before peer release
Crypto completion callbacks hold both key-slot and peer references. The
peer reference pins the netdev, and dropping the last peer reference can
let netdev unregistration and module removal make progress.
Do not release that peer reference before the callback has finished its
own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can
schedule an RCU callback backed by module text after ovpn_cleanup
rcu_barrier has already run. The TX error path also freed the remaining
skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev
lifetime window.
Release the key slot and free any remaining skb first, then drop the peer
reference as the last callback action.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
8534731dbf2d52a539b94defd06d2a8d3514aacb , < a3a676495c6419e0cca04d6a67227604e92a3d5a
(git)
Affected: 8534731dbf2d52a539b94defd06d2a8d3514aacb , < 4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517 (git) Affected: 8534731dbf2d52a539b94defd06d2a8d3514aacb , < 9e163917a86c6adfbe150e13f4c73653a54616de (git) |
guessed | |
| Linux | Linux |
Affected:
6.16
Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3a676495c6419e0cca04d6a67227604e92a3d5a",
"status": "affected",
"version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
"versionType": "git"
},
{
"lessThan": "4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517",
"status": "affected",
"version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
"versionType": "git"
},
{
"lessThan": "9e163917a86c6adfbe150e13f4c73653a54616de",
"status": "affected",
"version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ovpn/io.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in async crypto completion callbacks reached from the RX datapath (ovpn_udp_encap_recv/ovpn_tcp_rcv -\u003e ovpn_recv -\u003e ovpn_decrypt_post), which processes OpenVPN DATA_V2 packets sent over the network to an internet-facing kernel-offloaded VPN server.\nAC:L - An attacker controls packet timing and volume and can race peer teardown by withholding valid traffic to trigger keepalive expiry or closing the transport while in-flight decrypt/encrypt callbacks complete, so success does not depend on conditions outside attacker influence.\nPR:N - Exploitation requires only sending network packets to a host already running ovpn DCO; no local shell, CAP_NET_ADMIN, or other host privileges are needed by the remote attacker to reach the vulnerable callback cleanup ordering.\nUI:N - Triggering the race requires only automated packet transmission and concurrent peer/interface teardown; no victim user interaction such as opening files or mounting filesystems is required.\nS:U - Impact is confined to kernel memory and code within the same security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Premature peer release lets RCU/work callbacks run after netdev/module teardown, creating a use-after-free that can expose freed kernel objects and enable arbitrary memory disclosure when reclaimed memory is attacker-influenced.\nI:H - Scheduling RCU callbacks backed by unloaded ovpn module text is a classic kernel UAF that can be groomed into arbitrary write or control-flow hijack for ring-0 code execution, not merely a bounded corruption.\nA:H - Executing freed module text or dereferencing peer/netdev state outside its lifetime readily causes kernel oops/panic and complete denial of service on the VPN gateway."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:15.137Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a"
},
{
"url": "https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517"
},
{
"url": "https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de"
}
],
"title": "ovpn: finish crypto callback cleanup before peer release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80519",
"datePublished": "2026-08-26T14:37:01.383Z",
"dateReserved": "2026-08-26T14:34:25.763Z",
"dateUpdated": "2026-08-27T05:01:15.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80519",
"date": "2026-08-27",
"epss": "0.00448",
"percentile": "0.37241"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80519\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:05.420\",\"lastModified\":\"2026-08-27T06:17:30.167\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\novpn: finish crypto callback cleanup before peer release\\n\\nCrypto completion callbacks hold both key-slot and peer references. The\\npeer reference pins the netdev, and dropping the last peer reference can\\nlet netdev unregistration and module removal make progress.\\n\\nDo not release that peer reference before the callback has finished its\\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\\nschedule an RCU callback backed by module text after ovpn_cleanup\\nrcu_barrier has already run. The TX error path also freed the remaining\\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\\nlifetime window.\\n\\nRelease the key slot and free any remaining skb first, then drop the peer\\nreference as the last callback action.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ovpn/io.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8534731dbf2d52a539b94defd06d2a8d3514aacb\",\"lessThan\":\"a3a676495c6419e0cca04d6a67227604e92a3d5a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8534731dbf2d52a539b94defd06d2a8d3514aacb\",\"lessThan\":\"4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8534731dbf2d52a539b94defd06d2a8d3514aacb\",\"lessThan\":\"9e163917a86c6adfbe150e13f4c73653a54616de\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ovpn/io.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-27T13:38:21+00:00",
"cve": "CVE-2026-80519",
"id": "CVE-2026-80519",
"initial_release_date": "2026-08-26T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ovpn: finish crypto callback cleanup before peer release",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80519.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…