CVE-2026-74750

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ovpn module where key slots are released through a kref, and the release path frees AEAD (Authenticated Encryption with Associated Data) transforms from an RCU (Read-Copy-Update) callback. This process is unsafe for certain crypto implementations because the crypto free aead() function can sleep, which is not permitted within an RCU callback context, particularly when hardware or async implementations require teardown work.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.