CRITICAL Introduced in 6.16
ovpn CryptoCallback UAF
CVE-2026-80519
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.
02KernelScan AI Analysis
Risk summary
A network attacker can send malformed packets to an OpenVPN endpoint to trigger a drop path where cleanup ordering allows a use-after-free of module text. If the peer reference is dropped before key-slot cleanup, module removal can proceed and free code that a pending RCU callback still references, leading to kernel memory corruption or a crash. Exploitation requires winning a race between packet processing and peer teardown.
Vulnerability analysis
In the ovpn kernel OpenVPN packet processing code, the error and drop paths for both receive and transmit release the peer reference before releasing the cryptographic key slot and freeing the packet buffer. The peer reference pins the network device, so dropping it first can allow device unregistration and module removal to proceed while key-slot cleanup is still pending. The key-slot release may schedule an RCU callback that references module text which has already been freed, resulting in a use-after-free. The fix reorders all cleanup operations so the key slot is released and any remaining packet buffer is freed first, and the peer reference is dropped only as the final action, keeping all callback cleanup within the peer and device lifetime window. An attacker on the network can reach this path by sending malformed packets to an OpenVPN endpoint; the race window opens when a peer is being torn down concurrently, such as during connection timeout or disconnection.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.46 | a3a676495c64 |
| 7.1 | 6.16 | 7.1.10 | 4b0de8be288f |
| mainline | 6.16 | 7.2 | 9e163917a86c |