CVE-2026-80519

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ovpn: finish crypto callback cleanup before peer release<br /> <br /> Crypto completion callbacks hold both key-slot and peer references. The<br /> peer reference pins the netdev, and dropping the last peer reference can<br /> let netdev unregistration and module removal make progress.<br /> <br /> Do not release that peer reference before the callback has finished its<br /> own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can<br /> schedule an RCU callback backed by module text after ovpn_cleanup<br /> rcu_barrier has already run. The TX error path also freed the remaining<br /> skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev<br /> lifetime window.<br /> <br /> Release the key slot and free any remaining skb first, then drop the peer<br /> reference as the last callback action.