Module-Own Workqueue Vulnerability in Linux Kernel Affects OpenVPN

CVE-2026-80753

What is CVE-2026-80753?

A vulnerability exists in the Linux kernel related to OpenVPN due to improper management of deferred work on a module-owned workqueue. The issue arises when OpenVPN queues work items that execute module code on the global workqueues. During module exit, these work items can still run, allowing for potential device teardown while the OpenVPN code is being executed. This can lead to scenarios where a workqueue function might not have completed its execution, thereby risking the integrity of object references that are supposed to protect against such concurrency issues. To mitigate this vulnerability, a dedicated module-owned workqueue has been introduced for OpenVPN, ensuring that all queued work items are properly managed and do not outlive the module text during system cleanup operations.

References