CVE-2026-80520

A flaw was found in the ovpn module of the Linux kernel. The ovpn_crypto_kill_key function incorrectly assumes that both crypto key slots are always populated. This can lead to a NULL dereference if a peer has only one installed key or if the function attempts to remove a key that is not present. A local attacker could potentially use this flaw to cause a denial of service.

A moderate-severity NULL pointer dereference flaw was found in the ovpn (kernel OpenVPN) module of the Linux kernel. The ovpn_crypto_kill_key() function assumed that both peer crypto key slots were always populated and dereferenced each slot before verifying that it was non-NULL. Because a peer may have only one installed key, and the key-removal path may be asked to remove a key that is not present, this can lead to a NULL pointer dereference, causing a kernel panic and a local denial of service. The ovpn module was introduced upstream in Linux kernel version 6.16, and this vulnerable code is not present in the kernel packages shipped with Red Hat Enterprise Linux or Red Hat In-Vehicle OS; consequently, all Red Hat products are marked not affected for this flaw. Red Hat rates this flaw as Moderate (CVSS 3.1 score of 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVE.org score of 7.5, because triggering the flaw requires local access and local privileges on the system rather than unauthenticated network access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.