Executive brief
The Linux kernel's OpenVPN network driver (ovpn) had an unsafe memory management issue when releasing cryptographic key slots. The driver was attempting to free crypto resources (AEAD transforms) from an RCU callback context where sleeping operations are prohibited, but some hardware crypto implementations require sleep-capable teardown. This could cause kernel panics or memory corruption when using certain crypto accelerators. The fix defers the actual crypto teardown to a workqueue, where sleeping is permitted.
Technical details
This vulnerability exists in the OpenVPN (ovpn) network driver within the Linux kernel. The root cause is an unsafe use of RCU (Read-Copy-Update) callbacks to free AEAD cryptographic transforms: the original code called crypto_free_aead() from an RCU callback (ovpn_ks_destroy_rcu), but this function can sleep when used with async or hardware crypto implementations. RCU callbacks must not sleep or block. When key slots are released via kref_put(), the reference counting triggered the unsafe RCU callback. An attacker can trigger this by establishing and terminating OpenVPN connections using hardware-accelerated crypto, causing a kernel panic (BUG: sleeping function called from invalid context). The fix uses queue_rcu_work() to defer the actual crypto teardown to a workqueue context where sleeping is permitted, while maintaining the RCU grace period semantics needed for lockless key-slot readers. No user authentication is required; the attack requires only the ability to create network connections to trigger key slot allocation and release cycles.
Affected products
- Linux Linux Kernel affected versions prior to fix commit 2da3dfa1ddfe55a065f484750c83660e3bd4ac00
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched: upstream fix committed