EUVD-2026-66580
GHSA-2495-48wf-cqx2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable via OpenVPN protocol, but requires async or hardware-backed AEAD to trigger sleep-in-atomic crash, warranting AC:H over NVD's AC:L; no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ovpn: defer key slot crypto freeing to workqueue
Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: crypto_free_aead can sleep, for example when an async or hardware implementation has teardown work to complete.
Use queue_rcu_work for key-slot release. This keeps the RCU grace period needed by lockless key-slot readers, but runs the actual crypto teardown from workqueue context where sleeping is allowed. Once the rcu_work callback runs, pre-existing RCU readers are gone, and the final kref put already proves that no transform user remains, so the worker can release the AEAD transforms and free the slot directly.
The previous patch drains ovpn_wq during module exit, so queued key-slot teardown work cannot outlive module text.
AnalysisAI
Unsafe sleeping in atomic context within the Linux kernel's ovpn module can crash affected systems during VPN key slot teardown. When AEAD crypto transforms are freed via a plain RCU callback, implementations backed by asynchronous or hardware crypto accelerators may block inside crypto_free_aead - an operation forbidden in softirq/atomic context - triggering a kernel BUG or panic and denying service to the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must hold simultaneously: (1) the ovpn Linux kernel module must be loaded and managing active VPN sessions - systems using only userspace OpenVPN are unaffected; (2) the AEAD transform assigned to a key slot must be backed by an asynchronous or hardware-accelerated crypto implementation that can sleep during teardown - synchronous software-only AEAD backends (the common default) do not trigger the crash; and (3) a key slot release must occur, which happens normally during VPN session teardown or key renegotiation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.5 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H characterizes this as a network-reachable, low-complexity availability impact, but the AC:L rating is likely optimistic: the crash condition requires the ovpn module to be actively managing connections AND the underlying AEAD implementation to be asynchronous or hardware-backed, which is not the default on most general-purpose Linux deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote OpenVPN peer initiates or forces a key renegotiation with a gateway running the ovpn kernel module on a system where the AEAD cipher is implemented by an asynchronous or hardware crypto accelerator. When the old key slot's reference count drops to zero and the RCU callback fires, crypto_free_aead blocks waiting for hardware teardown in atomic context, immediately triggering a kernel BUG and crashing the host. … |
| Remediation | Upgrade the Linux kernel to version 7.2 or 7.1.10, which incorporate the queue_rcu_work fix for safe AEAD transform teardown out of atomic context. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux 6.16 or unpatched stable branches with the ovpn kernel module enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today