CVE-2026-74750

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ovpn: defer key slot crypto freeing to workqueue<br /> <br /> Key slots are released through a kref and the existing release path<br /> frees the AEAD transforms from an RCU callback. That is not safe for all<br /> crypto implementations: crypto_free_aead can sleep, for example when an<br /> async or hardware implementation has teardown work to complete.<br /> <br /> Use queue_rcu_work for key-slot release. This keeps the RCU grace period<br /> needed by lockless key-slot readers, but runs the actual crypto teardown<br /> from workqueue context where sleeping is allowed. Once the rcu_work<br /> callback runs, pre-existing RCU readers are gone, and the final kref put<br /> already proves that no transform user remains, so the worker can release<br /> the AEAD transforms and free the slot directly.<br /> <br /> The previous patch drains ovpn_wq during module exit, so queued key-slot<br /> teardown work cannot outlive module text.