CVE-2026-80520
High
Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the kill path may be asked to remove a key that is not present. Read each slot once while holding the crypto state lock, check for NULL before looking at key_id, and only replace the slot that actually matches.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Linux
PublishedAug 26, 2026
First seenAug 26, 2026
How to fix
Update
- Linux Linuxa47a080d06ee9d94dc6a2da0fc2b9beeeedb92b3, acf32a5dff082044cf0fd9492f3c10b7357c15ee, 41d44ac7a61e2f74453af40d4fe1b82af9ea0ada or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 89d3c0e4612afa1c6429ed68d298e35592fbe208 ≤ v < a47a080d06ee9d94dc6a2da0fc2b9beeeedb92b3, 89d3c0e4612afa1c6429ed68d298e35592fbe208 ≤ v < acf32a5dff082044cf0fd9492f3c10b7357c15ee, 89d3c0e4612afa1c6429ed68d298e35592fbe208 ≤ v < 41d44ac7a61e2f74453af40d4fe1b82af9ea0ada, 6.16 | a47a080d06ee9d94dc6a2da0fc2b9beeeedb92b3, acf32a5dff082044cf0fd9492f3c10b7357c15ee, 41d44ac7a61e2f74453af40d4fe1b82af9ea0ada |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.