CVE-2026-80520: ovpn: fix NULL dereference when killing missing key
In the Linux kernel, the following vulnerability has been resolved:
ovpn: fix NULL dereference when killing missing key
ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present.
Read each slot once while holding the crypto state lock, check for NULL before looking at keyid, and only replace the slot that actually matches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using ovpn peers are exposed when a peer has only one installed crypto key and the key-kill path is asked to remove a key that is not present.
What condition triggers the crash?
The vulnerable kill path dereferences both crypto-key slots before verifying that either slot is non-NULL. Requesting removal of a missing key while one slot is unpopulated can therefore cause a NULL dereference.
What does the fix change?
The fix reads the crypto slots while holding the crypto state lock, checks each slot for NULL before accessing its key ID, and replaces only the slot whose key ID matches the requested key.