CVE-2026-98604
Received Received - Intake

OpenVPN Kernel Local Endpoint Race Condition

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published through peer->bind with RCU, but local endpoint learning updates bind->local in place under peer->lock. UDP TX reads the field without that lock. In particular, a concurrent IPv6 update can therefore result in a torn address read. Use ovpn_peer_reset_sockaddr to publish a replacement bind when learning a new local endpoint, just as a remote endpoint change does. Preserve the current remote address and reset the dst cache only after the new bind has been published successfully. Track remote endpoint changes separately so that float notification and transport-address rehashing remain limited to actual peer floats.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98604
EUVD
EUVD-2026-103649

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux f0281c1d3732d1ec084fa1e06d1767d33e1a570e
Linux Linux f0281c1d3732d1ec084fa1e06d1767d33e1a570e
Linux Linux f0281c1d3732d1ec084fa1e06d1767d33e1a570e
Linux Linux 6.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in OpenVPN (ovpn) where the local endpoint address can be read inconsistently. The issue occurs because the local endpoint is updated in place under a lock, but UDP transmissions read it without that lock. A concurrent IPv6 update could cause a torn read of the address.

Detection Guidance

This vulnerability is specific to the Linux kernel's OpenVPN implementation and involves a race condition in endpoint binding. Detection requires checking kernel logs for related errors or kernel crashes during OpenVPN operations. No direct commands are provided in the context, but monitoring for kernel panics or OpenVPN service failures may indicate exploitation.

Impact Analysis

This could lead to network communication issues or potential data corruption if the local endpoint address is read incorrectly during VPN operations. It may cause instability in OpenVPN connections or unexpected behavior in network routing.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. Restart OpenVPN services after updating to ensure the patched kernel is active. Monitor system logs for any signs of exploitation or instability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart