Executive brief
The Linux kernel's OpenVPN module contains a reference-counting flaw in its cryptographic packet processing code. When packets are processed, the module holds references to both encryption keys and network peers; improper cleanup order can allow the network module to be unloaded while pending cleanup tasks remain scheduled, leading to execution of freed code and potential system crashes or privilege escalation.
Technical details
The vulnerability is a use-after-free in the ovpn (OpenVPN) kernel module's packet I/O path, specifically in the order of reference cleanup after crypto operations. Crypto completion callbacks hold both key-slot and peer references; the peer reference pins the network device in memory. If ovpn_crypto_key_slot_put() executes after ovpn_peer_put(), it can schedule an RCU (read-copy-update) callback backed by module text after the ovpn_cleanup rcu_barrier has completed, allowing the module to unload while the callback remains pending. The TX error path compounds this by freeing packet buffers after the peer reference is dropped, leaving callback cleanup outside the peer/netdev lifetime window. The fix reorders cleanup to release the key slot and free remaining packets before dropping the peer reference, ensuring all callbacks complete before module unload. No user interaction or authentication is required; any network packet processed by the ovpn module can trigger the race condition.
Affected products
- Linux Linux kernel All versions with ovpn module prior to commit 9e163917a86c6adfbe150e13f4c73653a54616de
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched: Upstream patch committed