CVE-2026-80753: ovpn: run deferred work on a module-owned workqueue
In the Linux kernel, the following vulnerability has been resolved:
ovpn: run deferred work on a module-owned workqueue
ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed.
Object references protect the objects used by the callbacks, but they do not prove that a workqueue function has returned. In particular, a worker can drop the final reference that unblocks device teardown while it is still executing ovpn code.
Add a module-owned workqueue and queue all ovpn work items on it. During module exit, unregister rtnl and netlink first, flush the workqueue so ordinary ovpn workers finish, run the final RCU barrier, and destroy the workqueue last. This keeps the workqueue available for cleanup work queued from RCU callbacks, while ensuring no ovpn work item can outlive the module text.
The per-device delayed keepalive work remains explicitly disabled during netdev teardown (disabledelayedworksync in ndouninit), since flushworkqueue does not flush delayed work that is still only pending on its timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add a module-owned workqueue and queue all ovpn work items on it. During module exit, unregister rtnl and netlink first, flush the workqueue so ordinary ovpn workers finish, run the final RCU barrier, and destroy the workqueue last.
- Compensating control
Keep per-device delayed keepalive work explicitly disabled during netdev teardown by calling disable_delayed_work_sync in ndo_uninit, because flush_workqueue does not flush delayed work that remains pending on its timer.
Event History
Frequently Asked Questions
When does the unsafe lifetime condition arise?
It arises during ovpn module exit, when work items executing ovpn module code are still running on global system workqueues as the module text may be freed. Object references can protect callback objects but do not guarantee that the workqueue callback itself has returned.
What ordering is required during module shutdown to prevent callbacks from outliving the module?
The resolved shutdown sequence unregisters rtnl and netlink first, flushes the module-owned workqueue, performs the final RCU barrier, and destroys the workqueue last. Keeping the workqueue until after the RCU barrier permits cleanup work queued by RCU callbacks to run safely.
Are delayed keepalive jobs covered by the workqueue flush?
No. Per-device delayed keepalive work must be explicitly disabled with disable_delayed_work_sync during netdev teardown, because flush_workqueue does not flush delayed work that has not yet become runnable.