Linux Kernel ovpn CVE-2026-80520

The affected kernel must include the ovpn module and the module must be loaded and managing active VPN peers - systems not using the in-kernel OpenVPN data plane are not exposed regardless of kernel version. The vulnerable commit range begins at 89d3c0e4612afa1c6429ed68d298e35592fbe208 (ovpn introduction) and ends at the respective fix commits for each stable branch. Triggering the NULL dereference requires inducing a key-kill operation against a peer that has only one of its two crypto slots populated; whether this is achievable by a completely unauthenticated, pre-handshake party or requires an established peer relationship is not confirmed from the description text alone - the CVSS PR:N rating implies the former but is not independently verified. Exploitation is not possible against kernels where ovpn is absent, unloaded, or has no active peers.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) implies fully unauthenticated remote exploitation, which deserves scrutiny: in OpenVPN's peer model, triggering the kill_key code path may require at minimum a partially established peer connection rather than a blind unsolicited packet, meaning the PR:N and AC:L ratings could overstate reachability. EPSS data was not present in the provided intelligence, preventing a probabilistic exploitation estimate. No CISA KEV listing and no public POC have been identified, collectively indicating this is not currently being exploited at scale. That said, the consequence for an affected VPN gateway is a kernel null-pointer dereference panic and complete service outage - a high-severity operational impact for any network perimeter or remote-access infrastructure. The 'Information Disclosure' tag in the source data does not match the actual impact (availability only, C:N/I:N/A:H) and should be treated as a tagging error rather than an additional risk signal.

An attacker acting as a connected OpenVPN peer (or injecting crafted ovpn key-management messages) triggers a key-kill operation against a peer object that has only one crypto slot populated. The kernel executes ovpn_crypto_kill_key, dereferences the NULL second slot without checking, and panics, crashing the VPN gateway and denying service to all tunneled connections. No public POC has been identified, but the logic flaw is straightforward: the vulnerable path is deterministically reachable when the target peer's crypto state has a single slot.