---
id: "CVE-2026-98604"
kind: "vulnerability"
aliases: ["CVE-2026-98604"]
title: "Linux kernel ovpn: torn read of peer local address during endpoint update"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "openvpn", "ovpn", "runtime"]
not_affected_if: ["ovpn-module-not-loaded"]
published_at: "2026-10-18T16:17:13+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98604", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel ovpn: torn read of peer local address during endpoint update

The ovpn driver in the Linux kernel updated a peer's local endpoint address in place without the RCU publish that UDP transmit paths rely on. A concurrent IPv6 update could let a reader see a half-written address, which can misdirect or corrupt traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit replacing the bind when learning the local endpoint (the sources do not name a version).

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98604

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ovpn: replace bind when learning local endpoint

struct ovpn_bind is published through peer->bind with RCU, but local
endpoint learning updates bind->local in place under peer->lock. UDP TX
reads the field without that lock. In particular, a concurrent IPv6
update can therefore result in a torn address read.

Use ovpn_peer_reset_sockaddr to publish a replacement bind when learning
a new local endpoint, just as a remote endpoint change does. Preserve
the current remote address and reset the dst cache only after the new
bind has been published successfully.

Track remote endpoint changes separately so that float notification and
transport-address rehashing remain limited to actual peer floats.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_