SB20260827115 - Use-after-free in Linux kernel net ovpn driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-80519)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free in the ovpn crypto completion callback handling in drivers/net/ovpn/io.c when processing crafted network packets. A remote attacker can send crafted packets that trigger asynchronous callback cleanup after peer release to execute arbitrary code.

The issue is caused by releasing the peer reference before key-slot cleanup and skb freeing are completed in the callback path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4b0de8be288f5fbec5d8ee64ed4e8b14bf19b517
• https://git.kernel.org/stable/c/9e163917a86c6adfbe150e13f4c73653a54616de
• https://git.kernel.org/stable/c/a3a676495c6419e0cca04d6a67227604e92a3d5a