{"id":"CVE-2026-98604","kind":"vulnerability","aliases":["CVE-2026-98604"],"related":[],"title":"Linux kernel ovpn: torn read of peer local address during endpoint update","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: replace bind when learning local endpoint\n\nstruct ovpn_bind is published through peer->bind with RCU, but local\nendpoint learning updates bind->local in place under peer->lock. UDP TX\nreads the field without that lock. In particular, a concurrent IPv6\nupdate can therefore result in a torn address read.\n\nUse ovpn_peer_reset_sockaddr to publish a replacement bind when learning\na new local endpoint, just as a remote endpoint change does. Preserve\nthe current remote address and reset the dst cache only after the new\nbind has been published successfully.\n\nTrack remote endpoint changes separately so that float notification and\ntransport-address rehashing remain limited to actual peer floats.","summary":"The ovpn driver in the Linux kernel updated a peer's local endpoint address in place without the RCU publish that UDP transmit paths rely on. A concurrent IPv6 update could let a reader see a half-written address, which can misdirect or corrupt traffic.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","openvpn","ovpn","runtime"],"not_affected_if":["ovpn-module-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit replacing the bind when learning the local endpoint (the sources do not name a version).","status":"open","published_at":"2026-10-18T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:30+00:00","updated_at":"2026-10-25T05:21:30+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:21:30Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit replacing the bind when learning the local endpoint (the sources do not name a version).","reach":"unknown","title":"Linux kernel ovpn: torn read of peer local address during endpoint update","impact":"low","summary":"The ovpn driver in the Linux kernel updated a peer's local endpoint address in place without the RCU publish that UDP transmit paths rely on. A concurrent IPv6 update could let a reader see a half-written address, which can misdirect or corrupt traffic.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ovpn","openvpn"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: a torn address read may misroute or corrupt tunnel traffic","analyst_note":"Sources give only the kernel commit text; check the NVD entry and the stable kernel changelog for affected and fixed versions and the real impact of the torn read.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["ovpn-module-not-loaded"],"who_is_affected":"Systems running the Linux kernel with the ovpn (OpenVPN data-channel offload) module loaded and in use, where peers are configured with IPv6 endpoints. Systems without the ovpn module, or that do not use it, are unlikely to be exposed. The sources do not describe the attacker's position.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3465,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98604':15A,18A 'actual':191C 'address':9A,38B,64B,130C,159C,186C 'bind':83C,90C,95C,103C,141C,169C 'cach':164C 'chang':153C,177C 'concurr':52B,121C 'corrupt':69B 'could':55B 'current':157C 'cve':13A,16A 'driver':27B 'dst':163C 'endpoint':11A,37B,87C,100C,147C,152C,176C 'field':114C 'float':181C,193C 'follow':76C 'half':62B 'half-written':61B 'ipv6':53B,122C 'kernel':2A,21B,31B,74C 'learn':85C,101C,143C 'let':56B 'limit':189C 'linux':1A,20B,30B,73C 'linux-kernel':19B 'local':8A,36B,86C,99C,104C,146C 'lock':109C,117C 'misdirect':67B 'new':145C,168C 'notif':182C 'openvpn':22B 'ovpn':3A,23B,26B,81C,89C,133C 'particular':119C 'path':48B 'peer':7A,34B,94C,108C,134C,192C 'place':40B,106C 'preserv':155C 'publish':44B,92C,138C,172C 'rcu':43B,97C 'read':5A,112C,131C 'reader':58B 'rehash':187C 'reli':49B 'remain':188C 'remot':151C,158C,175C 'replac':82C,140C 'reset':135C,161C 'resolv':80C 'result':126C 'runtim':24B 'see':59B 'separ':178C 'sockaddr':136C 'struct':88C 'success':173C 'therefor':125C 'torn':4A,129C 'track':174C 'traffic':70B 'transmit':47B 'transport':185C 'transport-address':184C 'tx':111C 'udp':46B,110C 'updat':12A,32B,54B,102C,123C 'use':132C 'vulner':77C 'without':41B,115C 'written':63B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the ovpn (OpenVPN data-channel offload) module loaded and in use, where peers are configured with IPv6 endpoints. Systems without the ovpn module, or that do not use it, are unlikely to be exposed. The sources do not describe the attacker's position.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98604","severity":null,"published_at":"2026-10-18T16:17:13+00:00","modified_at":"2026-10-19T10:19:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}