CVE-2026-80519: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80519 Overview

CVE-2026-80519 affects the Linux kernel's ovpn (OpenVPN data-channel offload) module. The vulnerability stems from incorrect ordering during crypto completion callback cleanup. Crypto callbacks hold references to both the key slot and the peer, and the peer reference pins the underlying netdev. Releasing the peer reference before the callback finishes its own cleanup can allow netdev unregistration and module unload to proceed while an RCU callback backed by module text is still pending. This creates a use-after-free condition tied to module lifetime.

Critical Impact
An RCU callback can execute against memory backed by unloaded module text, leading to kernel memory corruption, denial of service, or potential code execution in kernel context.

Affected Products

Linux kernel versions containing the ovpn (OpenVPN data-channel offload) module prior to the fixing commits
Distributions shipping the affected mainline ovpn module
Systems using OpenVPN kernel offload for VPN termination

Discovery Timeline

2026-08-26 - CVE-2026-80519 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80519

Vulnerability Analysis

The ovpn module performs asynchronous crypto operations that complete via callbacks. Each callback holds two references: one to the key slot and one to the peer object. The peer reference is significant because it pins the associated netdev, keeping the network device and its owning module resident in memory.

When a callback drops the peer reference prematurely, the last peer reference can be released while cleanup work remains. Once the peer reference count reaches zero, netdev unregistration can complete and the ovpn module can be unloaded. If ovpn_crypto_key_slot_put then runs after ovpn_peer_put, it may schedule an RCU callback whose function pointer resolves into module text that has already been freed. The ovpn_cleanup routine's rcu_barrier will have already executed, so nothing prevents the stale callback from firing later.

The transmit error path exhibits the same defect: it freed the remaining skb after ovpn_peer_put, placing callback cleanup outside the peer and netdev lifetime window.

Root Cause

The root cause is incorrect ordering of reference releases in ovpn crypto completion paths. The peer reference, which anchors module lifetime, is released before dependent cleanup that itself schedules RCU work backed by module text.

Attack Vector

An attacker with the ability to send crafted VPN traffic to a system using ovpn can trigger crypto completion paths and unbalanced reference handling. Combined with a module unload event or netdev teardown, this can race the pending RCU callback against freed module memory. Successful exploitation results in kernel memory corruption or a system crash.

The upstream fix reorders cleanup: release the key slot and free any residual skb first, then drop the peer reference as the final callback action. See the kernel commits 4b0de8be288f, 9e163917a86c, and a3a676495c64 for the corrected ordering.

Detection Methods for CVE-2026-80519

Indicators of Compromise

Kernel oops or general protection fault entries in dmesg referencing ovpn_crypto_key_slot_put, ovpn_peer_put, or RCU callback invocation
Unexpected kernel panics correlated with ovpn module unload or VPN interface teardown
KASAN or KFENCE reports flagging use-after-free within ovpn symbol ranges

Detection Strategies

Enumerate running kernel versions and confirm whether the ovpn module is loaded using lsmod | grep ovpn
Monitor kernel logs for RCU stalls, invalid opcodes, or backtraces containing ovpn symbols after netdev teardown
Correlate VPN tunnel disconnects and module reload events with subsequent kernel instability

Monitoring Recommendations

Ingest kernel logs (journalctl -k, /var/log/kern.log) into a central data lake for pattern analysis
Alert on repeated ovpn symbol occurrences within kernel crash traces
Track module load and unload events (kmod audit rules) on VPN gateways

How to Mitigate CVE-2026-80519

Immediate Actions Required

Inventory hosts running the ovpn kernel module and prioritize VPN gateways and concentrators for patching
Apply the stable kernel updates containing commits 4b0de8be288f, 9e163917a86c, and a3a676495c64
Reboot systems after patching to ensure the fixed kernel is active

Patch Information

The fix is applied in the upstream Linux kernel. The corrected callback releases the key slot and frees any remaining skb before dropping the peer reference, keeping cleanup within the peer and netdev lifetime window. Consult your distribution's advisory for backported kernel packages and reboot to activate the patched image.

Workarounds

Unload the ovpn module (modprobe -r ovpn) on systems that do not require kernel-mode OpenVPN offload and use userspace OpenVPN instead
Restrict network exposure of VPN endpoints to trusted sources until patched
Avoid runtime unload and reload of the ovpn module on production systems to reduce race exposure

bash

# Verify installed kernel and ovpn module status
uname -r
lsmod | grep ovpn

# Remove the ovpn module if not required
sudo modprobe -r ovpn

# Apply distribution kernel updates and reboot
sudo apt-get update && sudo apt-get upgrade -y   # Debian/Ubuntu
sudo dnf update -y kernel                         # RHEL/Fedora
sudo reboot