{"api_version":"1","generated_at":"2026-08-28T12:14:25+00:00","cve":"CVE-2026-80519","urls":{"html":"https://cve.report/CVE-2026-80519","api":"https://cve.report/api/cve/CVE-2026-80519.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80519","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80519"},"summary":{"title":"ovpn: finish crypto callback cleanup before peer release","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-26 15:17:05","updated_at":"2026-08-27 06:17:30"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de","name":"https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a","name":"https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517","name":"https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80519","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80519","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8534731dbf2d52a539b94defd06d2a8d3514aacb a3a676495c6419e0cca04d6a67227604e92a3d5a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8534731dbf2d52a539b94defd06d2a8d3514aacb 4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8534731dbf2d52a539b94defd06d2a8d3514aacb 9e163917a86c6adfbe150e13f4c73653a54616de git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.46 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.10 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"80519","cve":"CVE-2026-80519","epss":"0.004480000","percentile":"0.372410000","score_date":"2026-08-27","updated_at":"2026-08-28 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ovpn/io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a3a676495c6419e0cca04d6a67227604e92a3d5a","status":"affected","version":"8534731dbf2d52a539b94defd06d2a8d3514aacb","versionType":"git"},{"lessThan":"4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517","status":"affected","version":"8534731dbf2d52a539b94defd06d2a8d3514aacb","versionType":"git"},{"lessThan":"9e163917a86c6adfbe150e13f4c73653a54616de","status":"affected","version":"8534731dbf2d52a539b94defd06d2a8d3514aacb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ovpn/io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.46","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.46","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.10","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in async crypto completion callbacks reached from the RX datapath (ovpn_udp_encap_recv/ovpn_tcp_rcv -> ovpn_recv -> ovpn_decrypt_post), which processes OpenVPN DATA_V2 packets sent over the network to an internet-facing kernel-offloaded VPN server.\nAC:L - An attacker controls packet timing and volume and can race peer teardown by withholding valid traffic to trigger keepalive expiry or closing the transport while in-flight decrypt/encrypt callbacks complete, so success does not depend on conditions outside attacker influence.\nPR:N - Exploitation requires only sending network packets to a host already running ovpn DCO; no local shell, CAP_NET_ADMIN, or other host privileges are needed by the remote attacker to reach the vulnerable callback cleanup ordering.\nUI:N - Triggering the race requires only automated packet transmission and concurrent peer/interface teardown; no victim user interaction such as opening files or mounting filesystems is required.\nS:U - Impact is confined to kernel memory and code within the same security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Premature peer release lets RCU/work callbacks run after netdev/module teardown, creating a use-after-free that can expose freed kernel objects and enable arbitrary memory disclosure when reclaimed memory is attacker-influenced.\nI:H - Scheduling RCU callbacks backed by unloaded ovpn module text is a classic kernel UAF that can be groomed into arbitrary write or control-flow hijack for ring-0 code execution, not merely a bounded corruption.\nA:H - Executing freed module text or dereferencing peer/netdev state outside its lifetime readily causes kernel oops/panic and complete denial of service on the VPN gateway."}]}],"providerMetadata":{"dateUpdated":"2026-08-27T05:01:15.137Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a"},{"url":"https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517"},{"url":"https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de"}],"title":"ovpn: finish crypto callback cleanup before peer release","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80519","datePublished":"2026-08-26T14:37:01.383Z","dateReserved":"2026-08-26T14:34:25.763Z","dateUpdated":"2026-08-27T05:01:15.137Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-26 15:17:05","lastModifiedDate":"2026-08-27 06:17:30","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80519","Ordinal":"1","Title":"ovpn: finish crypto callback cleanup before peer release","CVE":"CVE-2026-80519","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80519","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: finish crypto callback cleanup before peer release\n\nCrypto completion callbacks hold both key-slot and peer references. The\npeer reference pins the netdev, and dropping the last peer reference can\nlet netdev unregistration and module removal make progress.\n\nDo not release that peer reference before the callback has finished its\nown cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can\nschedule an RCU callback backed by module text after ovpn_cleanup\nrcu_barrier has already run. The TX error path also freed the remaining\nskb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev\nlifetime window.\n\nRelease the key slot and free any remaining skb first, then drop the peer\nreference as the last callback action.","Type":"Description","Title":"ovpn: finish crypto callback cleanup before peer release"}]}}}