Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work… (CVE-2026-80753)

The Linux kernel ovpn module queues several work items whose callbacks execute module code. Previously, these work items ran on global system workqueues, which lack a driver-owned drain point to guarantee that callbacks have fully returned before the module text is freed during module exit. Although object references protect the objects used by callbacks, they do not ensure the workqueue function has returned, allowing a worker to drop the final reference that unblocks device teardown while still executing ovpn code. The fix adds a module-owned workqueue and queues all ovpn work items on it. During module exit, rtnl and netlink are unregistered first, the workqueue is flushed to finish ovpn workers, a final RCU barrier is run, and the workqueue is destroyed last. This ensures no ovpn work item can outlive the module text, preventing use-after-free scenarios. The per-device delayed keepalive work remains disabled during netdev teardown because flush_workqueue does not flush delayed work pending on its timer.

This vulnerability can lead to use-after-free conditions where ovpn work item callbacks execute after the module text has been freed. This can cause kernel crashes or potentially allow an attacker to execute arbitrary code with kernel privileges. The CVSS score of 8.4 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel by introducing a module-owned workqueue for ovpn work items and properly flushing it during module exit. Users should update to the Linux kernel version that includes this fix. Since no patch links are provided here, check the official Linux kernel advisories or vendor updates for the fixed version and apply the update accordingly.