{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-80753", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.790Z", "datePublished": "2026-09-03T08:26:32.564Z", "dateUpdated": "2026-09-04T04:58:33.659Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-04T04:58:33.659Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: run deferred work on a module-owned workqueue\n\novpn queues several work items whose callbacks execute module text.\nThese works currently run on the global system workqueues, so module\nexit has no driver-owned drain point that guarantees the callbacks have\nfully returned before the module text can be freed.\n\nObject references protect the objects used by the callbacks, but they do\nnot prove that a workqueue function has returned. In particular, a\nworker can drop the final reference that unblocks device teardown while\nit is still executing ovpn code.\n\nAdd a module-owned workqueue and queue all ovpn work items on it. During\nmodule exit, unregister rtnl and netlink first, flush the workqueue so\nordinary ovpn workers finish, run the final RCU barrier, and destroy the\nworkqueue last. This keeps the workqueue available for cleanup work\nqueued from RCU callbacks, while ensuring no ovpn work item can outlive\nthe module text.\n\nThe per-device delayed keepalive work remains explicitly disabled during\nnetdev teardown (disable_delayed_work_sync in ndo_uninit), since\nflush_workqueue does not flush delayed work that is still only pending\non its timer." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The module-text UAF is triggered in ovpn_cleanup() during local rmmod/module exit; although defer_del_work, keepalive_work, and tcp_tx_work are queued from remote TCP VPN traffic via ovpn_tcp_rcv() and ovpn_tcp_write_space(), there is no network-reachable path into module_exit itself.\nAC:L - Per CNA driver-removal UAF precedent, an attacker controls the work side by sustaining remote OpenVPN transport traffic (malformed TCP frames, transport errors, or write-space callbacks) while root or package-manager rmmod during upgrade races unpooled system_wq workers still executing ovpn module callbacks.\nPR:N - Privileged module unload opens the window, but concurrent execution of ovpn work on system_percpu_wq is driven by remote VPN peers sending transport frames to configured offload tunnels; no Linux account, CAP_NET_ADMIN, or CAP_SYS_MODULE on the victim is required for that half.\nUI:N - No victim user interaction beyond normal VPN gateway operation and routine kernel/module maintenance; remote peers autonomously schedule ovpn work items when sending transport frames to established offload tunnels.\nS:U - Freed module-text UAF corrupts kernel code and data within the same host security boundary; impact is standard in-kernel privilege escalation or panic, not VM escape, container boundary crossing, or IOMMU bypass.\nC:H - Use-after-free of ovpn module .text lets freed page contents be attacker-influenced via heap or page reuse while the worker still executes callback instructions, yielding arbitrary kernel memory read primitives per UAF guidance.\nI:H - Executing freed module text provides a control-flow hijack surface into kernel context; combined with slab spraying over recycled module pages this enables arbitrary kernel write and local privilege escalation beyond mere denial of service.\nA:H - Running ovpn workqueue handlers after module text is unmapped reliably causes kernel oops or panic from invalid instruction fetches, and repeated rmmod races against active VPN traffic yield repeatable denial of service on internet-facing gateways." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ovpn/main.c", "drivers/net/ovpn/ovpnpriv.h", "drivers/net/ovpn/peer.c", "drivers/net/ovpn/tcp.c" ], "versions": [ { "version": "11851cbd60ea1e5abbd97619d69845ead99303d6", "lessThan": "bbe81f40582d451ac849b20707784220f33a23bd", "status": "affected", "versionType": "git" }, { "version": "11851cbd60ea1e5abbd97619d69845ead99303d6", "lessThan": "e9714db8041763f59dde152c812b96b3de05c6d9", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ovpn/main.c", "drivers/net/ovpn/ovpnpriv.h", "drivers/net/ovpn/peer.c", "drivers/net/ovpn/tcp.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/bbe81f40582d451ac849b20707784220f33a23bd" }, { "url": "https://git.kernel.org/stable/c/e9714db8041763f59dde152c812b96b3de05c6d9" } ], "title": "ovpn: run deferred work on a module-owned workqueue", "x_generator": { "engine": "bippy-1.2.0" } } } }