SB2026090415 - Use-after-free in Linux kernel net ovpn driver
Published: September 4, 2026
Security Bulletin ID
SB2026090415
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Use-after-free (CVE-ID: CVE-2026-80753)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a use-after-free of module text.
The vulnerability exists due to improper workqueue lifecycle management in ovpn deferred work handling when unloading the ovpn module while its work items execute on global system workqueues. A local privileged user can unload the ovpn module while ovpn work items remain queued to cause a use-after-free of module text.
Remediation
Install update from vendor's website.