CVE-2026-98603: ovpn: replace bind when clearing stale local source

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ovpn: replace bind when clearing stale local source

The UDP output fallback clears bind->local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an IPv6 reader can observe a torn address.

Retry the route lookup with source address autoselection without modifying the bind. After a successful lookup, revalidate the bind and route key under peer->lock, reset the dst cache, and best-effort publish a replacement bind with a wildcard local address.

Do not cache the resolved dst when clearing the local source. Replacing the source invalidates all per-CPU cache entries, while dstcachesetip4 and dstcachesetip6 update only the current CPU slot. The current packet can still use the resolved route; if bind allocation fails, a later cache miss retries the repair.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:19 PM

Data Sourced

via MITRE·03:19 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux kernel's ovpn component with UDP output are exposed when a remembered local source address becomes unusable and the fallback path clears that source while concurrent transmit operations read the RCU-published bind.

What must occur for the race condition to be triggered?

A stale remembered local source address must require UDP route-lookup fallback, while concurrent TX reads the bind locklessly. The described impact specifically involves an IPv6 reader observing a torn address during the in-place update.

What mitigation is available if the kernel fix cannot be deployed immediately?

The provided information does not identify a configuration workaround. The resolved implementation avoids modifying the published bind in place and instead publishes a replacement bind with a wildcard local address after route lookup succeeds.

CVE-2026-98603: ovpn: replace bind when clearing stale local source

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must occur for the race condition to be triggered?

What mitigation is available if the kernel fix cannot be deployed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must occur for the race condition to be triggered?

What mitigation is available if the kernel fix cannot be deployed immediately?