CVE-2026-80520: ovpn: fix NULL dereference when killing missing key
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix NULL dereference when killing missing key
ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present.
Read each slot once while holding the crypto state lock, check for NULL before looking at keyid, and only replace the slot that actually matches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel ovpn code so ovpn_crypto_kill_key reads each crypto slot once while holding the crypto state lock, checks for NULL before reading key_id (or other fields), and only replaces the slot that matches the key being killed; this prevents NULL dereference when the kill path is asked to remove a key that is not present.
Linux kernel (ovpn: fix NULL dereference when killing missing key) ovpn_crypto_kill_key null checking behavior = Implement NULL dereference prevention by checking for NULL before dereferencing crypto slots and only replacing the slot that actually matches (read each slot once while holding the crypto state lock).