{"id":"CVE-2026-98603","kind":"vulnerability","aliases":["CVE-2026-98603"],"related":[],"title":"Linux kernel ovpn: unlocked source-address update can tear IPv6 reads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: replace bind when clearing stale local source\n\nThe UDP output fallback clears bind->local in place when the remembered\nsource address is no longer usable. The bind is RCU-published and read\nlocklessly by concurrent TX, so an IPv6 reader can observe a torn\naddress.\n\nRetry the route lookup with source address autoselection without\nmodifying the bind. After a successful lookup, revalidate the bind and\nroute key under peer->lock, reset the dst cache, and best-effort publish\na replacement bind with a wildcard local address.\n\nDo not cache the resolved dst when clearing the local source. Replacing\nthe source invalidates all per-CPU cache entries, while\ndst_cache_set_ip4 and dst_cache_set_ip6 update only the current CPU\nslot. The current packet can still use the resolved route; if bind\nallocation fails, a later cache miss retries the repair.","summary":"The Linux kernel's ovpn driver clears a peer's remembered local source address in place while concurrent transmit paths read it without a lock, so an IPv6 reader can see a torn address. The sources do not state a confirmed attacker outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","openvpn","ovpn","self-hosted"],"not_affected_if":["ovpn-module-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit replacing the bind when clearing stale local source in ovpn.","status":"open","published_at":"2026-10-18T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:31+00:00","updated_at":"2026-10-25T05:21:31+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:21:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit replacing the bind when clearing stale local source in ovpn.","reach":"unknown","title":"Linux kernel ovpn: unlocked source-address update can tear IPv6 reads","impact":"low","summary":"The Linux kernel's ovpn driver clears a peer's remembered local source address in place while concurrent transmit paths read it without a lock, so an IPv6 reader can see a torn address. The sources do not state a confirmed attacker outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ovpn","openvpn","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; torn address read, impact not stated in sources","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed kernel versions and the actual impact of the torn read.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["ovpn-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the ovpn (OpenVPN data channel offload) module, particularly peers using UDP with IPv6 where the remembered source address becomes unusable. Hosts without the ovpn module loaded are not affected. The sources do not give further detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3522,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98603':15A,18A 'address':7A,41B,61B,102C,127C,134C,169C 'alloc':218C 'attack':69B 'autoselect':135C 'best':159C 'best-effort':158C 'bind':83C,94C,108C,139C,146C,164C,217C 'cach':156C,172C,189C,193C,198C,222C 'clear':34B,85C,93C,177C 'concurr':45B,117C 'confirm':68B 'cpu':188C,205C 'current':204C,208C 'cve':13A,16A 'driver':33B 'dst':155C,175C,192C,197C 'effort':160C 'entri':190C 'fail':219C 'fallback':92C 'follow':76C 'host':27B 'infrastructur':19B 'invalid':184C 'ip4':195C 'ip6':200C 'ipv6':11A,55B,121C 'kernel':2A,22B,30B,74C 'key':149C 'later':221C 'linux':1A,21B,29B,73C 'linux-kernel':20B 'local':39B,87C,95C,168C,179C 'lock':52B,152C 'lockless':115C 'longer':105C 'lookup':131C,143C 'miss':223C 'modifi':137C 'observ':124C 'openvpn':23B 'outcom':70B 'output':91C 'ovpn':3A,24B,32B,81C 'packet':209C 'path':47B 'peer':36B,151C 'per':187C 'per-cpu':186C 'place':43B,97C 'publish':112C,161C 'rcu':111C 'rcu-publish':110C 'read':12A,48B,114C 'reader':56B,122C 'rememb':38B,100C 'repair':226C 'replac':82C,163C,181C 'reset':153C 'resolv':80C,174C,214C 'retri':128C,224C 'revalid':144C 'rout':130C,148C,215C 'see':58B 'self':26B 'self-host':25B 'set':194C,199C 'slot':206C 'sourc':6A,40B,63B,88C,101C,133C,180C,183C 'source-address':5A 'stale':86C 'state':66B 'still':211C 'success':142C 'tear':10A 'torn':60B,126C 'transmit':46B 'tx':118C 'udp':90C 'unlock':4A 'updat':8A,201C 'usabl':106C 'use':212C 'vulner':77C 'wildcard':167C 'without':50B,136C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ovpn (OpenVPN data channel offload) module, particularly peers using UDP with IPv6 where the remembered source address becomes unusable. Hosts without the ovpn module loaded are not affected. The sources do not give further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98603","severity":null,"published_at":"2026-10-18T16:17:13+00:00","modified_at":"2026-10-19T10:19:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}