CVE-2026-80520: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80520 Overview

CVE-2026-80520 is a NULL pointer dereference vulnerability in the Linux kernel's ovpn (OpenVPN data-channel) module. The flaw resides in the ovpn_crypto_kill_key function, which assumes both crypto slots on a peer are populated. The function dereferences each slot to read its key_id before performing a NULL check. When a peer has only one installed key, or when the kill path is invoked for a key that is not present, the unchecked dereference triggers a kernel NULL pointer access.

A remote attacker able to influence key-removal requests can crash the kernel, resulting in denial of service on affected systems running the in-kernel OpenVPN implementation.

Critical Impact
A remote, unauthenticated attack path can trigger a kernel NULL pointer dereference in the ovpn module, causing a system crash and loss of availability for VPN gateways and endpoints.

Affected Products

Linux kernel versions containing the ovpn in-kernel OpenVPN data-channel module prior to the fix commits
Distributions shipping kernels with the ovpn module enabled
VPN gateways and endpoints using the in-kernel OpenVPN acceleration path

Discovery Timeline

2026-08-26 - CVE-2026-80520 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80520

Vulnerability Analysis

The vulnerability affects the ovpn_crypto_kill_key routine in the Linux kernel's ovpn module. The routine walks the peer's crypto slot array to locate and remove a key matching a given identifier. The original implementation reads the key_id field of each slot before validating whether the slot pointer itself is non-NULL.

A peer in the ovpn subsystem may hold only one active key at a time. Any slot that has not been provisioned remains NULL. When user space or a control message requests removal of a key that is absent, the kill path walks both slots and dereferences the NULL slot pointer to compare its key_id, producing an oops in kernel context.

The fix reads each slot pointer once while holding the crypto state lock, checks for NULL prior to accessing key_id, and replaces only the slot that actually matches the requested key. This vulnerability falls under the Null Pointer Dereference class and manifests as a kernel-level denial of service.

Root Cause

The root cause is an ordering error in pointer validation. ovpn_crypto_kill_key accesses slot->key_id before verifying slot != NULL. The code path assumed both crypto slots are always populated, an invariant that does not hold for peers with a single installed key or when a stale removal is issued.

Attack Vector

The attack vector is network-accessible according to the assigned CVSS metrics. Any control-plane condition or peer interaction that induces a key-removal call for a non-existent or single-slot key will reach the vulnerable code path. Successful triggering produces a kernel oops and terminates VPN service on the target host.

No verified public exploit code is available. See the upstream kernel patches for technical details: Kernel commit 41d44ac7a61e, Kernel commit a47a080d06ee, and Kernel commit acf32a5dff08.

Detection Methods for CVE-2026-80520

Indicators of Compromise

Kernel oops or panic messages referencing ovpn_crypto_kill_key in dmesg or /var/log/kern.log
Unexpected termination of the ovpn interface with NULL pointer dereference stack traces
Repeated VPN tunnel resets correlated with peer key rotation or teardown events

Detection Strategies

Inventory running kernels and confirm whether the ovpn module is loaded using lsmod | grep ovpn
Correlate kernel crash telemetry with OpenVPN control-plane activity to identify triggering peers
Compare running kernel build IDs against distribution advisories referencing the three upstream fix commits

Monitoring Recommendations

Forward kern.log and dmesg output to a centralized log platform and alert on oops signatures containing ovpn_crypto_
Monitor VPN gateway availability metrics for correlated crash and reboot patterns
Track kernel package versions across the fleet and flag hosts still running vulnerable builds

How to Mitigate CVE-2026-80520

Immediate Actions Required

Apply the vendor-supplied kernel update that incorporates the upstream ovpn fix commits
Restrict VPN control-plane exposure to trusted management networks until patching is complete
Reboot affected hosts after patch installation to load the corrected kernel

Patch Information

The fix is available in the upstream Linux kernel through three stable commits: 41d44ac7a61e2f74453af40d4fe1b82af9ea0ada, a47a080d06ee9d94dc6a2da0fc2b9beeeedb92b3, and acf32a5dff082044cf0fd9492f3c10b7357c15ee. The patch reorders slot access to read each slot pointer once under the crypto state lock, checks for NULL before dereferencing key_id, and replaces only the matching slot. Consult your distribution's security tracker for the specific package version containing these commits.

Workarounds

Unload the ovpn module with modprobe -r ovpn on hosts that do not require the in-kernel OpenVPN data path
Fall back to the userspace OpenVPN implementation until the kernel patch is deployed
Constrain peer configurations so that key add and remove operations occur only from trusted orchestration components

bash

# Verify installed kernel version and check whether the ovpn module is active
uname -r
lsmod | grep ovpn

# Temporary mitigation: unload the ovpn module if not required
sudo modprobe -r ovpn

# Prevent automatic reload until patching is complete
echo "blacklist ovpn" | sudo tee /etc/modprobe.d/blacklist-ovpn.conf