Look up another CVE · open CVE-2026-80519 in the interactive tracker
CVE-2026-80519
ovpn: finish crypto callback cleanup before peer release
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80519 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ovpn/io.c
- What this is
- OPENVPN DATA CHANNEL OFFLOADMAINTAINERS section matched on drivers/net/ovpn/ · openvpn-devel@lists.sourceforge.net · Supported
- Kernel module
- ovpn
Check it on the machine
grep -w CONFIG_OVPN /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ovpnPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release with an answer below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidm
- ?
- not established - no Makefile entry for the affected file
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_OVPN
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.65%, higher than 50.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.16 | 6.18.46 | a3a676495c64 |
| 6.16 | 7.1.10 | 4b0de8be288f |
| 6.16 | 7.2 | 9e163917a86c |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is in async crypto completion callbacks reached from the RX datapath (ovpn_udp_encap_recv/ovpn_tcp_rcv -> ovpn_recv -> ovpn_decrypt_post), which processes OpenVPN DATA_V2 packets sent over the network to an internet-facing kernel-offloaded VPN server.
- AC:LAttack complexity, low
- An attacker controls packet timing and volume and can race peer teardown by withholding valid traffic to trigger keepalive expiry or closing the transport while in-flight decrypt/encrypt callbacks complete, so success does not depend on conditions outside attacker influence.
- PR:NPrivileges required, none
- Exploitation requires only sending network packets to a host already running ovpn DCO; no local shell, CAP_NET_ADMIN, or other host privileges are needed by the remote attacker to reach the vulnerable callback cleanup ordering.
- UI:NUser interaction, none
- Triggering the race requires only automated packet transmission and concurrent peer/interface teardown; no victim user interaction such as opening files or mounting filesystems is required.
- S:UScope, unchanged
- Impact is confined to kernel memory and code within the same security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.
- C:HConfidentiality impact, high
- Premature peer release lets RCU/work callbacks run after netdev/module teardown, creating a use-after-free that can expose freed kernel objects and enable arbitrary memory disclosure when reclaimed memory is attacker-influenced.
- I:HIntegrity impact, high
- Scheduling RCU callbacks backed by unloaded ovpn module text is a classic kernel UAF that can be groomed into arbitrary write or control-flow hijack for ring-0 code execution, not merely a bounded corruption.
- A:HAvailability impact, high
- Executing freed module text or dereferencing peer/netdev state outside its lifetime readily causes kernel oops/panic and complete denial of service on the VPN gateway.