Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion… (CVE-2026-80519)

The Linux kernel ovpn crypto completion callbacks hold references to both key slots and peers. The peer reference pins the network device (netdev), and dropping the last peer reference prematurely allows netdev unregistration and module removal to proceed unsafely. Specifically, if ovpn_crypto_key_slot_put is called after ovpn_peer_put, it may schedule an RCU callback referencing module text after ovpn_cleanup's RCU barrier has executed, causing use-after-free. Additionally, the TX error path frees remaining skb buffers after ovpn_peer_put, placing callback cleanup outside the valid peer/netdev lifetime window. The fix ensures that the key slot is released and any remaining skb freed before dropping the peer reference as the final callback action.

This vulnerability can lead to use-after-free conditions in the Linux kernel's ovpn module, potentially causing system crashes, arbitrary code execution, or denial of service. The CVSS v3.1 score is 9.8, indicating critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific workaround or temporary mitigation is provided in the available data.