Executive brief
The Linux kernel's OpenVPN (ovpn) module contains a NULL pointer dereference vulnerability in its cryptographic key removal function. When a peer attempts to remove a cryptographic key that is not installed or when only one key is present, the kernel crashes rather than gracefully handling the missing key. This can cause denial of service if exploited on systems running affected kernel versions with ovpn module loaded.
Technical details
The vulnerability is a NULL pointer dereference in the ovpn_crypto_kill_key() function in drivers/net/ovpn/crypto.c. The function assumed both crypto key slots are always populated and dereferenced them to access the key_id field before checking for NULL pointers. However, a VPN peer may have only one active key installed, or may receive a request to remove a key that does not exist. An attacker can trigger this by sending a kill request for a non-existent key ID. The fix checks each slot for NULL before dereferencing and validates the key_id matches before attempting removal. No authentication bypass or remote code execution is possible, but this leads to a kernel panic and denial of service.
Affected products
- Linux Linux kernel 5.19 and later (up to and including affected 6.x versions prior to patch)
Timeline
- 2026-08-26: disclosed
- 2026-08-07: patched