CVE-2026-80753

The Linux kernel's ovpn module (the OpenVPN data-channel offload driver) queued deferred work items whose callbacks execute module code on global system workqueues, so during module unload there was no guarantee those callbacks had finished before the kernel freed the module's text — a race that amounts to executing freed module code (a use-after-unload/use-after-free condition). It is triggered locally when the module exits while ovpn work is still in flight, for example when a worker drops the last object reference and thereby unblocks device teardown while it is still running ovpn code. An attacker with local access who can time VPN tunnel teardown against a module load/unload could trigger kernel memory corruption with high impact to confidentiality, integrity and availability (CVSS 8.4), typically a kernel crash or oops and potentially exploitable for privilege escalation. Only systems whose kernels build the ovpn driver and actually load it — i.e., deployments using the new kernel-side OpenVPN offload — are affected, and the driver's per-device keepalive timer work is separately synchronized during network-device teardown. There are no known public exploits, proofs of concept, or reports of in-the-wild exploitation, and the 30-day exploitation probability is very low (EPSS ~0.1%).

What to do: Update to a kernel that includes the ovpn fix, which moves all ovpn work to a module-owned workqueue flushed during module exit; check your distribution's security advisories for backported packages. As an interim mitigation, avoid unloading or reloading the ovpn module while VPN tunnels are active. Determine exposure by checking whether the ovpn module is loaded on your systems — if it is not loaded, you are not affected.