CVE-2026-80519

A flaw was found in the Linux kernel. Specifically, within the OpenVPN (OVPN) module's crypto completion callback mechanism, a timing issue exists. This vulnerability arises when peer references are released prematurely, before the associated cleanup operations are complete. An attacker could potentially exploit this to trigger a use-after-free condition, leading to system instability or a denial of service (DoS).

Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this Moderate-severity Linux kernel flaw, because the vulnerable ovpn (OpenVPN) module code is not present in any shipped Red Hat kernel version. The flaw is a use-after-free in the ovpn module's crypto completion callback cleanup. These callbacks hold both key-slot and peer references, and the peer reference pins the netdev; when the peer reference is dropped before the callback has finished its own cleanup, an RCU callback backed by module text can be scheduled after ovpn_cleanup's rcu_barrier has already run, and the TX error path can free the remaining skb outside the peer/netdev lifetime window. A local attacker with the ability to interact with the ovpn module on an affected kernel could exploit this timing flaw to trigger a use-after-free, resulting in a kernel panic and denial of service. Red Hat rates this flaw Moderate (CVSS 5.5, availability impact only) because exploitation requires local access and privileges; this differs from the Critical 9.8 score in the upstream CVE record, which assumes a network attack vector with no privileges or user interaction that is not consistent with the local, privilege-gated attack path of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.