CVE-2026-80519
Received Received - Intake

Use-After-Free in Linux Kernel OpenVPN Crypto

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80519
EUVD
EUVD-2026-66585

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a crypto callback cleanup is not properly handled before releasing a peer reference. The issue occurs when the peer reference is dropped before the callback finishes cleanup, potentially leading to module removal and netdev unregistration issues. The fix ensures the key slot is released and remaining skb freed before dropping the peer reference.

Detection Guidance

This vulnerability is specific to the Linux kernel's OpenVPN implementation and requires kernel-level inspection. Detection involves checking kernel logs for related errors or monitoring for crashes during VPN operations. Commands like dmesg, journalctl -k, or checking for kernel oops messages may help identify issues.

Impact Analysis

This vulnerability could cause system instability or crashes if the kernel improperly handles crypto callbacks during network operations. It may lead to memory corruption or use-after-free scenarios, potentially affecting network connectivity or causing kernel panics.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the affected OpenVPN kernel module or restricting VPN usage until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80519. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart