CVE-2026-74750
Description
A flaw was found in the Linux kernel's ovpn module. This vulnerability arises from an incorrect handling of cryptographic resource freeing, where a function that requires the ability to pause (sleep) is executed in a context that does not allow it. This improper resource management could lead to system instability or a kernel crash, potentially resulting in a Denial of Service (DoS) for the affected system.
Statement
A moderate-impact denial of service flaw was found in the Linux kernel ovpn module. Key slots in ovpn are released through a kref, and the release path frees the AEAD crypto transforms from an RCU callback. crypto_free_aead can sleep, for example when an asynchronous or hardware crypto implementation has teardown work to complete, and invoking it from an RCU callback where sleeping is not allowed can lead to system instability or a kernel crash. Red Hat scored this flaw Moderate with CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector with privileges required; this differs from the CVE.org score of 7.5, which is based on a network attack vector. None of the Red Hat Enterprise Linux or Red Hat In-Vehicle OS kernels listed for this flaw contain the vulnerable ovpn key-slot release code, so the shipped Red Hat kernel products are not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Memory; Read Memory; Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
