CVE-2026-74750

CVE-2026-74750 affects the Linux kernel ovpn (OpenVPN) module . Key slots are released via a kref, and the existing release path frees AEAD transforms from an RCU callback . This is unsafe because crypto_free_aead can sleep (e.g., when an async or hardware crypto implementation has teardown work ...