In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed. Object references protect the objects used by the callbacks, but they do not prove that a workqueue function has returned. In particular, a worker can drop the final reference that unblocks device teardown while it is still executing ovpn code. Add a module-owned workqueue and queue all ovpn work items on it. During module exit, unregister rtnl and netlink first, flush the workqueue so ordinary ovpn workers finish, run the final RCU barrier, and destroy the workqueue last. This keeps the workqueue available for cleanup work queued from RCU callbacks, while ensuring no ovpn work item can outlive the module te
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80753 is a use-after-free vulnerability in the Linux kernel's OpenVPN (ovpn) module stemming from improper workqueue management. The vulnerability occurs because deferred work items execute module code on global system workqueues without a module-owned drain point to guarantee callback completion before module unload. This creates a race condition where the module text can be freed while workqueue callbacks are still executing, leading to potential code execution or denial of service. This affects Linux systems running the ovpn kernel module, particularly those with dynamic module loading/unloading patterns or long-running VPN connections that queue work items during shutdown.
While this CVE currently has no mapped MITRE ATT&CK techniques, Casky's extended reasoning capabilities would detect the underlying attack patterns by analyzing kernel module lifecycle violations and resource synchronization failures. Practitioners using Casky would identify this as a Privilege Escalation or Code Execution vector through techniques like T1547 (Boot or Logon Autostart Execution) when considering persistent module behaviors, or T1053 (Scheduled Task/Job) given the deferred work scheduling nature. Casky's analysis would flag indicators such as: module unload operations without proper workqueue draining, callbacks executing after memory deallocation, and race conditions between module exit handlers and queued work items—demonstrating how AI-driven reasoning across the MITRE framework surface vulnerabilities even when direct technique mappings don't exist.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80753. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation