HIGH Introduced in 6.16
ovpn CryptoKeySlot Deref
CVE-2026-80520
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present. Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches.
02KernelScan AI Analysis
Risk summary
A local attacker with access to the ovpn interface can trigger a NULL pointer dereference in the crypto key-kill path, causing a kernel panic and denial of service. The vulnerability requires the ovpn module to be loaded and a peer with only one installed key.
Vulnerability analysis
The routine that removes an encryption key assumes both key entries are populated and dereferences each one before checking whether it exists. When a peer has only one key installed, or when the removal path is asked to delete a key that is not present, the code dereferences a NULL pointer, causing a kernel panic. The fix reads each entry once while holding the internal lock, checks for a valid pointer before inspecting the key, and only clears the entry that actually matches. This vulnerability is reachable locally by an attacker who can interact with the OpenVPN netlink interface, which requires administrative network privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.46 | a47a080d06ee |
| 7.1 | 6.16 | 7.1.10 | acf32a5dff08 |
| mainline | 6.16 | 7.2 | 41d44ac7a61e |