EUVD-2026-66586
GHSA-v79r-cp4c-r8xr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-facing VPN module; no authentication confirmed as required to reach the kill_key path; impact is availability only via kernel crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix NULL dereference when killing missing key
ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present.
Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches.
AnalysisAI
NULL pointer dereference in the Linux kernel's in-kernel OpenVPN data-plane module (ovpn) allows a network-reachable peer to crash the kernel by triggering key removal against a crypto slot that is not populated. Affected kernels span the ovpn-enabled range from commit 89d3c0e4612afa1c6429ed68d298e35592fbe208 through versions prior to 6.18.46, 7.1.10, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected kernel must include the ovpn module and the module must be loaded and managing active VPN peers - systems not using the in-kernel OpenVPN data plane are not exposed regardless of kernel version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) implies fully unauthenticated remote exploitation, which deserves scrutiny: in OpenVPN's peer model, triggering the kill_key code path may require at minimum a partially established peer connection rather than a blind unsolicited packet, meaning the PR:N and AC:L ratings could overstate reachability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker acting as a connected OpenVPN peer (or injecting crafted ovpn key-management messages) triggers a key-kill operation against a peer object that has only one crypto slot populated. The kernel executes ovpn_crypto_kill_key, dereferences the NULL second slot without checking, and panics, crashing the VPN gateway and denying service to all tunneled connections. … |
| Remediation | Upgrade to Linux 6.18.46, 7.1.10, or 7.2 (or later), all of which include the corrected ovpn_crypto_kill_key logic that reads each slot under the crypto state lock and NULL-checks before dereferencing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all production Linux VPN gateways running kernel versions prior to 6.18.46, 7.1.10, or 7.2 with the OpenVPN data-plane (ovpn) module active, and document the affected infrastructure baseline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today