ovpn: replace bind when learning local endpoint
In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published through peer->bind with RCU, but local endpoint learning updates bind->local in place under peer->lock. UDP TX reads the field without that lock. In particular, a concurrent IPv6 update can therefore result in a torn address read. Use ovpn_peer_reset_sockaddr to publish a replacement bind when learning a new local endpoint, just as a remote endpoint change does. Preserve the current remote address and reset the dst cache only after the new bind has been published successfully. Track remote endpoint changes separately so that float notification and transport-address rehashing remain limited to actual peer floats.
CVE-2026-98604
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98604
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f0281c1d3732d1ec084fa1e06d1767d33e1a570e",
"lessThan": "21dbc9f4d0bdd3b22f91beabc7840064bf11594f",
"versionType": "git"
},
{
"status": "affected",
"version": "f0281c1d3732d1ec084fa1e06d1767d33e1a570e",
"lessThan": "e283009151d3d131447c2edda500199c5fda5f72",
"versionType": "git"
},
{
"status": "affected",
"version": "f0281c1d3732d1ec084fa1e06d1767d33e1a570e",
"lessThan": "aea934a221ec6a867221e5b765f65f1857befd53",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ovpn/peer.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ovpn/peer.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98604
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38624 · Revision 1
- Added to Heist Feed
- Publisher date