CVE-2026-80520 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix NULL dereference when killing missing key
ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present.
Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in the OpenVPN implementation within the Linux kernel represents a critical logic error leading to a null pointer dereference during cryptographic key management operations. This flaw resides specifically within the ovpn_crypto_kill_key function, which is responsible for removing or invalidating encryption keys associated with peer connections. The root cause of this issue stems from an incorrect assumption regarding the state of crypto slots used by OpenVPN peers. In standard operation, a secure tunnel typically maintains two active cryptographic key sets to facilitate seamless transitions between them during rekeying events. However, the implementation failed to account for scenarios where only one key is currently installed or when the specific key targeted for removal does not exist in either slot. By blindly dereferencing both crypto slots before verifying their existence, the code triggers a kernel panic if an empty slot is accessed, resulting in a denial of service condition that can crash the host system or disrupt network connectivity for all users relying on that instance.
From a technical perspective, this vulnerability aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities where software fails to check for null pointers before using them. The operational impact is significant because it allows an attacker who has access to the OpenVPN management interface or can influence key lifecycle events to induce a system crash simply by triggering the removal of a non-existent or partially configured key set. This does not require remote code execution but serves as a reliable vector for local denial of service attacks against systems running vulnerable kernel versions with OpenVPN enabled. The flaw highlights a common pitfall in low-level network stack development where assumptions about state consistency are made without rigorous validation, particularly under concurrent access conditions or during edge-case cleanup routines.
To mitigate this risk, the resolution involves restructuring the key removal logic to ensure thread safety and null checks are performed correctly. The fix mandates that each crypto slot be read exactly once while holding the appropriate cryptographic state lock to prevent race conditions where the state might change between reads. Crucially, the implementation must verify that a pointer is not NULL before attempting to access any fields within it, such as key_id. Furthermore, the logic should only proceed with replacing or invalidating a specific slot if there is an actual match for the target key identifier. This ensures that operations are idempotent and safe even when keys are missing or partially configured. Administrators should apply kernel updates provided by their distribution vendors to patch this issue, as it affects core networking functionality within the Linux operating system. Monitoring systems for unexpected OpenVPN process terminations or kernel oops messages can help detect exploitation attempts in real-time before a full crash occurs.