CVE-2026-74750: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74750 Overview

CVE-2026-74750 affects the Linux kernel's ovpn (OpenVPN in-kernel) module. The vulnerability stems from unsafe cryptographic teardown in the key slot release path. Key slots are released through a kref, and the existing release path freed AEAD transforms from an RCU callback. This is unsafe because crypto_free_aead can sleep, particularly when asynchronous or hardware crypto implementations require teardown work. Sleeping in RCU callback context violates kernel invariants and can lead to instability on affected systems.

Critical Impact
An attacker capable of triggering key slot release paths in the ovpn module may cause kernel instability or denial of service on systems using asynchronous or hardware-backed AEAD crypto implementations.

Affected Products

Linux kernel versions containing the ovpn in-kernel OpenVPN implementation
Systems using async or hardware-backed AEAD crypto providers with ovpn
Distributions shipping the affected kernel revisions prior to the upstream fix

Discovery Timeline

2026-08-26 - CVE-2026-74750 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74750

Vulnerability Analysis

The ovpn module manages cryptographic key material through reference-counted key slots. When the final reference to a slot is released, the previous implementation scheduled AEAD transform teardown from an RCU callback via a standard call_rcu mechanism. RCU callbacks execute in softirq or similar non-sleepable contexts. However, crypto_free_aead may block when the underlying implementation is asynchronous or hardware-offloaded, since teardown requires waiting on device or worker completion.

Calling a sleeping function from an atomic RCU callback context can result in scheduler warnings, deadlocks, or kernel panics depending on workload and crypto provider. The impact aligns with an availability-only outcome: no confidentiality or integrity loss, but the affected kernel path can be pushed into an unstable state.

Root Cause

The root cause is a context mismatch between RCU callback execution and the sleeping requirement of crypto_free_aead. The release path in ovpn invoked crypto teardown directly from the RCU callback, violating the contract that RCU callbacks must not sleep. This is a kernel-level synchronization defect rather than a memory corruption flaw.

Attack Vector

The attack surface exists on systems terminating ovpn tunnels with async or hardware crypto backends. Traffic patterns or connection lifecycle events that cause frequent key slot rotation and release can trigger the unsafe teardown path. Because ovpn processes network-delivered control and data flows, the trigger is reachable over the network in configurations where the kernel module is active.

The upstream fix replaces call_rcu with queue_rcu_work, deferring the actual AEAD teardown to workqueue context where sleeping is permitted. The RCU grace period is preserved so lockless key-slot readers remain safe. A companion patch drains ovpn_wq at module exit so queued teardown work cannot outlive module text. See Kernel Git Commit 0f77ed5 and Kernel Git Commit 2da3dfa for the source-level changes.

Detection Methods for CVE-2026-74750

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic or sleeping function called from invalid context referencing crypto_free_aead or ovpn symbols.
Unexpected soft lockups, RCU stalls, or kernel panics on hosts running the in-kernel ovpn module.
Repeated crashes correlated with VPN session churn or key rotation events on affected kernels.

Detection Strategies

Inventory kernel versions across the fleet and flag hosts running ovpn module builds that predate the upstream fix commits.
Monitor dmesg and journalctl -k output for RCU-related warnings tied to crypto teardown call stacks.
Correlate VPN service restarts and tunnel renegotiation frequency with kernel-level stability alerts to identify systems reaching the vulnerable path.

Monitoring Recommendations

Ingest kernel logs into a centralized logging pipeline and alert on RCU stall, scheduling-while-atomic, and ovpn panic signatures.
Track uptime and unplanned reboots on VPN concentrators and gateways using in-kernel OpenVPN.
Baseline crypto backend selection (cryptsetup or /proc/crypto) to identify hosts running async or hardware AEAD providers most at risk of triggering the defect.

How to Mitigate CVE-2026-74750

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable commits 0f77ed5 and 2da3dfa or upgrade to a distribution kernel that includes them.
Identify all hosts using the in-kernel ovpn module and prioritize those with async or hardware AEAD crypto backends.
Schedule reboots after patch installation so the fixed kernel and module are loaded.

Patch Information

The fix replaces the RCU callback teardown with queue_rcu_work, deferring crypto_free_aead execution to workqueue context. A prerequisite patch drains ovpn_wq on module exit to ensure queued work cannot execute after module unload. Both changes are available in the mainline kernel and stable branches through Kernel Git Commit 0f77ed5 and Kernel Git Commit 2da3dfa.

Workarounds

Switch the AEAD crypto backend to a fully synchronous software implementation where feasible, reducing the likelihood of sleeping teardown paths.
Use the userspace OpenVPN daemon rather than the in-kernel ovpn module until patched kernels are deployed.
Blacklist or unload the ovpn module on systems that do not require in-kernel OpenVPN termination.

bash

# Verify kernel version and ovpn module status
uname -r
lsmod | grep ovpn

# Temporarily prevent module load until patched kernel is deployed
echo "blacklist ovpn" | sudo tee /etc/modprobe.d/blacklist-ovpn.conf
sudo update-initramfs -u