Vulnerability-Lookup

FKIE_CVE-2026-80519

Vulnerability from fkie_nvd - Published: 2026-08-26 15:17 - Updated: 2026-08-27 06:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3a676495c6419e0cca04d6a67227604e92a3d5a",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            },
            {
              "lessThan": "4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            },
            {
              "lessThan": "9e163917a86c6adfbe150e13f4c73653a54616de",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action."
    }
  ],
  "id": "CVE-2026-80519",
  "lastModified": "2026-08-27T06:17:30.167",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-26T15:17:05.420",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-80519 (GCVE-0-2026-80519)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01

Title

ovpn: finish crypto callback cleanup before peer release

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/a3a676495c6419e0c…
https://git.kernel.org/stable/c/4b0de8be288f5fbec…
https://git.kernel.org/stable/c/9e163917a86c6adfb…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8534731dbf2d52a539b94defd06d2a8d3514aacb , < a3a676495c6419e0cca04d6a67227604e92a3d5a (git) Affected: 8534731dbf2d52a539b94defd06d2a8d3514aacb , < 4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517 (git) Affected: 8534731dbf2d52a539b94defd06d2a8d3514aacb , < 9e163917a86c6adfbe150e13f4c73653a54616de (git)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3a676495c6419e0cca04d6a67227604e92a3d5a",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            },
            {
              "lessThan": "4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            },
            {
              "lessThan": "9e163917a86c6adfbe150e13f4c73653a54616de",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in async crypto completion callbacks reached from the RX datapath (ovpn_udp_encap_recv/ovpn_tcp_rcv -\u003e ovpn_recv -\u003e ovpn_decrypt_post), which processes OpenVPN DATA_V2 packets sent over the network to an internet-facing kernel-offloaded VPN server.\nAC:L - An attacker controls packet timing and volume and can race peer teardown by withholding valid traffic to trigger keepalive expiry or closing the transport while in-flight decrypt/encrypt callbacks complete, so success does not depend on conditions outside attacker influence.\nPR:N - Exploitation requires only sending network packets to a host already running ovpn DCO; no local shell, CAP_NET_ADMIN, or other host privileges are needed by the remote attacker to reach the vulnerable callback cleanup ordering.\nUI:N - Triggering the race requires only automated packet transmission and concurrent peer/interface teardown; no victim user interaction such as opening files or mounting filesystems is required.\nS:U - Impact is confined to kernel memory and code within the same security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Premature peer release lets RCU/work callbacks run after netdev/module teardown, creating a use-after-free that can expose freed kernel objects and enable arbitrary memory disclosure when reclaimed memory is attacker-influenced.\nI:H - Scheduling RCU callbacks backed by unloaded ovpn module text is a classic kernel UAF that can be groomed into arbitrary write or control-flow hijack for ring-0 code execution, not merely a bounded corruption.\nA:H - Executing freed module text or dereferencing peer/netdev state outside its lifetime readily causes kernel oops/panic and complete denial of service on the VPN gateway."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:15.137Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de"
        }
      ],
      "title": "ovpn: finish crypto callback cleanup before peer release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80519",
    "datePublished": "2026-08-26T14:37:01.383Z",
    "dateReserved": "2026-08-26T14:34:25.763Z",
    "dateUpdated": "2026-08-27T05:01:15.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-80519

CVE-2026-80519 (GCVE-0-2026-80519)

Tags

Sightings

Nomenclature