Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through… (CVE-2026-74750)

CVE-2026-74750 addresses a flaw in the Linux kernel's OpenVPN key slot release process. Key slots are released via a kref and previously freed AEAD transforms from an RCU callback, which is unsafe for crypto implementations where crypto_free_aead can sleep (e.g., async or hardware crypto). The patch changes the release to use queue_rcu_work, deferring the crypto teardown to a workqueue context that permits sleeping. This maintains the RCU grace period for lockless key-slot readers while safely freeing crypto resources after all readers have finished. The patch also ensures the workqueue is drained during module exit to prevent teardown work from outliving the module code.

The vulnerability could lead to unsafe freeing of cryptographic resources in the Linux kernel's OpenVPN implementation, potentially causing kernel instability or crashes (denial of service). There is no indication of confidentiality or integrity impact. The CVSS score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a network attack vector with no privileges required, no user interaction, and impact limited to availability.

A fix for this vulnerability has been implemented in the Linux kernel by deferring key slot crypto freeing to a workqueue context. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, updating to a patched kernel version is the recommended remediation. No additional mitigation steps are indicated.