Executive brief
The OpenVPN kernel module queued work items on global system workqueues, creating a risk that module cleanup could free the module's code while worker threads were still executing. This could allow a local attacker to trigger a use-after-free condition leading to kernel crash or potential code execution. The fix ensures all work items complete before the module is unloaded by using a module-owned workqueue.
Technical details
The vulnerability is a use-after-free in the Linux kernel's OpenVPN (ovpn) driver workqueue management. The ovpn module queued work items (keepalive and TCP transport callbacks) on global system workqueues, but had no driver-owned synchronization point to guarantee those callbacks returned before the module text was freed during module exit. While object reference counting protected the objects used by callbacks, it did not prove the workqueue function had returned—a worker could drop the final reference unblocking teardown while still executing ovpn code, leading to use-after-free. The fix adds a module-owned workqueue, ensures proper ordering during module cleanup (unregister interfaces, flush workqueue, run RCU barrier, destroy workqueue), and disables delayed work during netdev teardown. Attack requires local kernel module interaction; no network vector.
Affected products
- Linux Linux kernel affected versions prior to patch (commit e9714db8041763f59dde152c812b96b3de05c6d9)
Timeline
- 2026-09-03: disclosed: CVE-2026-80753 published
- 2026-09-03: patched: Fix committed upstream (commit e9714db8041763f59dde152c812b96b3de05c6d9)
- 2026-09-07: patched: Merged into stable tree (commit b5fe67111e63a8a81ec31056c4475509076fd266)