CVE-2026-80520

HighCVSS 7.5/10Last modified Aug 27, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ovpn: fix NULL dereference when killing missing key

ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present.

Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 89d3c0e4612afa1c6429ed68d298e35592fbe208, < a47a080d06ee9d94dc6a2da0fc2b9beeeedb92b3; >= 89d3c0e4612afa1c6429ed68d298e35592fbe208, < acf32a5dff082044cf0fd9492f3c10b7357c15ee; >= 89d3c0e4612afa1c6429ed68d298e35592fbe208, < 41d44ac7a61e2f74453af40d4fe1b82af9ea0ada
LinuxLinux6.16

References

Timeline

Published
Aug 26, 2026
Last modified
Aug 27, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-805217.8In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that CVE-2026-805227.8In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req(CVE-2026-805237.1In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsiblCVE-2026-80524In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in optee_ffa_lend_protmem Sashiko (locally)CVE-2026-80525In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setuCVE-2026-805267.8In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_controCVE-2026-805277.5In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader canCVE-2026-805289.8In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply(CVE-2026-80529In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquCVE-2026-80538.8An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger anCVE-2026-805307.1In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN CVE-2026-805317.8In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a p
CVE-2026-80520: High severity, CVSS 7.5 | Vulnix