CVE-2026-80753 (GCVE-0-2026-80753)

Vulnerability from cvelistv5 – Published: 2026-09-03 08:26 – Updated: 2026-09-07 15:45
VLAI
Title
ovpn: run deferred work on a module-owned workqueue
Summary
In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed. Object references protect the objects used by the callbacks, but they do not prove that a workqueue function has returned. In particular, a worker can drop the final reference that unblocks device teardown while it is still executing ovpn code. Add a module-owned workqueue and queue all ovpn work items on it. During module exit, unregister rtnl and netlink first, flush the workqueue so ordinary ovpn workers finish, run the final RCU barrier, and destroy the workqueue last. This keeps the workqueue available for cleanup work queued from RCU callbacks, while ensuring no ovpn work item can outlive the module text. The per-device delayed keepalive work remains explicitly disabled during netdev teardown (disable_delayed_work_sync in ndo_uninit), since flush_workqueue does not flush delayed work that is still only pending on its timer.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 11851cbd60ea1e5abbd97619d69845ead99303d6 , < b5fe67111e63a8a81ec31056c4475509076fd266 (git)
Affected: 11851cbd60ea1e5abbd97619d69845ead99303d6 , < bbe81f40582d451ac849b20707784220f33a23bd (git)
Affected: 11851cbd60ea1e5abbd97619d69845ead99303d6 , < e9714db8041763f59dde152c812b96b3de05c6d9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/main.c",
            "drivers/net/ovpn/ovpnpriv.h",
            "drivers/net/ovpn/peer.c",
            "drivers/net/ovpn/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5fe67111e63a8a81ec31056c4475509076fd266",
              "status": "affected",
              "version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
              "versionType": "git"
            },
            {
              "lessThan": "bbe81f40582d451ac849b20707784220f33a23bd",
              "status": "affected",
              "version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
              "versionType": "git"
            },
            {
              "lessThan": "e9714db8041763f59dde152c812b96b3de05c6d9",
              "status": "affected",
              "version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ovpn/main.c",
            "drivers/net/ovpn/ovpnpriv.h",
            "drivers/net/ovpn/peer.c",
            "drivers/net/ovpn/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: run deferred work on a module-owned workqueue\n\novpn queues several work items whose callbacks execute module text.\nThese works currently run on the global system workqueues, so module\nexit has no driver-owned drain point that guarantees the callbacks have\nfully returned before the module text can be freed.\n\nObject references protect the objects used by the callbacks, but they do\nnot prove that a workqueue function has returned. In particular, a\nworker can drop the final reference that unblocks device teardown while\nit is still executing ovpn code.\n\nAdd a module-owned workqueue and queue all ovpn work items on it. During\nmodule exit, unregister rtnl and netlink first, flush the workqueue so\nordinary ovpn workers finish, run the final RCU barrier, and destroy the\nworkqueue last. This keeps the workqueue available for cleanup work\nqueued from RCU callbacks, while ensuring no ovpn work item can outlive\nthe module text.\n\nThe per-device delayed keepalive work remains explicitly disabled during\nnetdev teardown (disable_delayed_work_sync in ndo_uninit), since\nflush_workqueue does not flush delayed work that is still only pending\non its timer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The module-text UAF is triggered in ovpn_cleanup() during local rmmod/module exit; although defer_del_work, keepalive_work, and tcp_tx_work are queued from remote TCP VPN traffic via ovpn_tcp_rcv() and ovpn_tcp_write_space(), there is no network-reachable path into module_exit itself.\nAC:L - Per CNA driver-removal UAF precedent, an attacker controls the work side by sustaining remote OpenVPN transport traffic (malformed TCP frames, transport errors, or write-space callbacks) while root or package-manager rmmod during upgrade races unpooled system_wq workers still executing ovpn module callbacks.\nPR:N - Privileged module unload opens the window, but concurrent execution of ovpn work on system_percpu_wq is driven by remote VPN peers sending transport frames to configured offload tunnels; no Linux account, CAP_NET_ADMIN, or CAP_SYS_MODULE on the victim is required for that half.\nUI:N - No victim user interaction beyond normal VPN gateway operation and routine kernel/module maintenance; remote peers autonomously schedule ovpn work items when sending transport frames to established offload tunnels.\nS:U - Freed module-text UAF corrupts kernel code and data within the same host security boundary; impact is standard in-kernel privilege escalation or panic, not VM escape, container boundary crossing, or IOMMU bypass.\nC:H - Use-after-free of ovpn module .text lets freed page contents be attacker-influenced via heap or page reuse while the worker still executes callback instructions, yielding arbitrary kernel memory read primitives per UAF guidance.\nI:H - Executing freed module text provides a control-flow hijack surface into kernel context; combined with slab spraying over recycled module pages this enables arbitrary kernel write and local privilege escalation beyond mere denial of service.\nA:H - Running ovpn workqueue handlers after module text is unmapped reliably causes kernel oops or panic from invalid instruction fetches, and repeated rmmod races against active VPN traffic yield repeatable denial of service on internet-facing gateways."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T15:45:09.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5fe67111e63a8a81ec31056c4475509076fd266"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbe81f40582d451ac849b20707784220f33a23bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9714db8041763f59dde152c812b96b3de05c6d9"
        }
      ],
      "title": "ovpn: run deferred work on a module-owned workqueue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80753",
    "datePublished": "2026-09-03T08:26:32.564Z",
    "dateReserved": "2026-08-26T14:34:25.790Z",
    "dateUpdated": "2026-09-07T15:45:09.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80753",
      "date": "2026-09-21",
      "epss": "0.00132",
      "percentile": "0.03164"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ovpn/main.c",
                  "drivers/net/ovpn/ovpnpriv.h",
                  "drivers/net/ovpn/peer.c",
                  "drivers/net/ovpn/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b5fe67111e63a8a81ec31056c4475509076fd266",
                    "status": "affected",
                    "version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bbe81f40582d451ac849b20707784220f33a23bd",
                    "status": "affected",
                    "version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e9714db8041763f59dde152c812b96b3de05c6d9",
                    "status": "affected",
                    "version": "11851cbd60ea1e5abbd97619d69845ead99303d6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ovpn/main.c",
                  "drivers/net/ovpn/ovpnpriv.h",
                  "drivers/net/ovpn/peer.c",
                  "drivers/net/ovpn/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novpn: run deferred work on a module-owned workqueue\n\novpn queues several work items whose callbacks execute module text.\nThese works currently run on the global system workqueues, so module\nexit has no driver-owned drain point that guarantees the callbacks have\nfully returned before the module text can be freed.\n\nObject references protect the objects used by the callbacks, but they do\nnot prove that a workqueue function has returned. In particular, a\nworker can drop the final reference that unblocks device teardown while\nit is still executing ovpn code.\n\nAdd a module-owned workqueue and queue all ovpn work items on it. During\nmodule exit, unregister rtnl and netlink first, flush the workqueue so\nordinary ovpn workers finish, run the final RCU barrier, and destroy the\nworkqueue last. This keeps the workqueue available for cleanup work\nqueued from RCU callbacks, while ensuring no ovpn work item can outlive\nthe module text.\n\nThe per-device delayed keepalive work remains explicitly disabled during\nnetdev teardown (disable_delayed_work_sync in ndo_uninit), since\nflush_workqueue does not flush delayed work that is still only pending\non its timer."
          }
        ],
        "id": "CVE-2026-80753",
        "lastModified": "2026-09-07T16:17:30.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-03T13:06:15.010",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5fe67111e63a8a81ec31056c4475509076fd266"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bbe81f40582d451ac849b20707784220f33a23bd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e9714db8041763f59dde152c812b96b3de05c6d9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.