{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3a676495c6419e0cca04d6a67227604e92a3d5a",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            },
            {
              "lessThan": "4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            },
            {
              "lessThan": "9e163917a86c6adfbe150e13f4c73653a54616de",
              "status": "affected",
              "version": "8534731dbf2d52a539b94defd06d2a8d3514aacb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in async crypto completion callbacks reached from the RX datapath (ovpn_udp_encap_recv/ovpn_tcp_rcv -\u003e ovpn_recv -\u003e ovpn_decrypt_post), which processes OpenVPN DATA_V2 packets sent over the network to an internet-facing kernel-offloaded VPN server.\nAC:L - An attacker controls packet timing and volume and can race peer teardown by withholding valid traffic to trigger keepalive expiry or closing the transport while in-flight decrypt/encrypt callbacks complete, so success does not depend on conditions outside attacker influence.\nPR:N - Exploitation requires only sending network packets to a host already running ovpn DCO; no local shell, CAP_NET_ADMIN, or other host privileges are needed by the remote attacker to reach the vulnerable callback cleanup ordering.\nUI:N - Triggering the race requires only automated packet transmission and concurrent peer/interface teardown; no victim user interaction such as opening files or mounting filesystems is required.\nS:U - Impact is confined to kernel memory and code within the same security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Premature peer release lets RCU/work callbacks run after netdev/module teardown, creating a use-after-free that can expose freed kernel objects and enable arbitrary memory disclosure when reclaimed memory is attacker-influenced.\nI:H - Scheduling RCU callbacks backed by unloaded ovpn module text is a classic kernel UAF that can be groomed into arbitrary write or control-flow hijack for ring-0 code execution, not merely a bounded corruption.\nA:H - Executing freed module text or dereferencing peer/netdev state outside its lifetime readily causes kernel oops/panic and complete denial of service on the VPN gateway."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:15.137Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de"
        }
      ],
      "title": "ovpn: finish crypto callback cleanup before peer release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80519",
    "datePublished": "2026-08-26T14:37:01.383Z",
    "dateReserved": "2026-08-26T14:34:25.763Z",
    "dateUpdated": "2026-08-27T05:01:15.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}