CVE-2026-80520
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/08/2026
Last modified:
27/08/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ovpn: fix NULL dereference when killing missing key<br />
<br />
ovpn_crypto_kill_key assumes both crypto slots are populated and<br />
dereferences each slot before checking it. That is not guaranteed: a<br />
peer can have only one installed key, and the kill path may be asked to<br />
remove a key that is not present.<br />
<br />
Read each slot once while holding the crypto state lock, check for NULL<br />
before looking at key_id, and only replace the slot that actually<br />
matches.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH