Description

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window. Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:17:05.420Z",
  "pubdate": "2026-08-26T15:17:05.420Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Linux kernel ovpn driver caused by improper management of object lifecycles during cryptographic callback completion. The flaw involves a race condition where the crypto callback cleanup logic executes after the associated peer and network device (netdev) references have been released.\nThe vulnerability allows for memory corruption or system crashes when the kernel attempts to execute RCU callbacks referencing module memory that has been unmapped due to module unloading. An attacker capable of triggering specific crypto-path error conditions or timing the tear-down process of an ovpn interface may be able to achieve arbitrary code execution or a kernel panic.\nThis issue stems from an incorrect order of operations in the cleanup sequence, specifically regarding the handling of key-slot references and skb (socket buffer) management. The impact is significant as it affects the stability and integrity of the kernel memory space. Exploitation requires the attacker to be able to influence the state of the ovpn interface or trigger concurrent netdev/module removal while crypto operations are pending.",
  "technicalDetails": "The root cause of this vulnerability is a lifetime mismatch between cryptographic callback cleanup tasks and the peer reference lifecycle within the ovpn driver. In the Linux kernel, the ovpn module manages peer objects and their associated key-slots to perform secure communication. Crypto completion callbacks are responsible for releasing these resources.\nPreviously, the driver would release the peer reference—which effectively pins the netdev and ensures the module remains loaded—before the crypto callback had fully finished its cleanup tasks. Because the peer reference is responsible for ensuring that the underlying netdev structure and module code remain resident in memory, dropping this reference prematurely creates a window of vulnerability.\nIf the function ovpn_crypto_key_slot_put executes after ovpn_peer_put, it may schedule an RCU (Read-Copy-Update) callback. If the module has already undergone cleanup, specifically after the rcu_barrier has completed in ovpn_cleanup, the kernel may attempt to jump to addresses in memory that no longer contain valid module text. This results in a use-after-free condition where the kernel attempts to execute code or access data associated with a deallocated structure.\nFurthermore, the TX (transmit) error path was identified as a problematic vector. It prematurely freed the remaining skb after the ovpn_peer_put operation, which meant the subsequent cleanup logic was operating outside the safety window of the peer/netdev lifecycle. This effectively de-synchronizes the callback's requirements from the kernel's reference counting mechanism.\nThe attack flow involves triggering a network state where an skb is being processed by the crypto layer. By forcing a specific error condition in the TX path or initiating an interface deletion while crypto requests are in flight, the attacker triggers the premature release of the peer reference. Once the reference count hits zero, the kernel proceeds with unregistering the netdev and potentially unloading the module. When the pending crypto callback finally runs, it accesses the dangling pointer or attempts to reference RCU callbacks that point to unmapped or reclaimed memory, leading to kernel instability or potential exploitation of the freed memory region."
}