{"id":"CVE-2026-98604","revision":"754b7aaf3fd44a2ea3074b6b89122274","records":[{"revision":"754b7aaf3fd44a2ea3074b6b89122274","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98604","aliases":[],"title":"ovpn: replace bind when learning local endpoint","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: replace bind when learning local endpoint\n\nstruct ovpn_bind is published through peer->bind with RCU, but local\nendpoint learning updates bind->local in place under peer->lock. UDP TX\nreads the field without that lock. In particular, a concurrent IPv6\nupdate can therefore result in a torn address read.\n\nUse ovpn_peer_reset_sockaddr to publish a replacement bind when learning\na new local endpoint, just as a remote endpoint change does. Preserve\nthe current remote address and reset the dst cache only after the new\nbind has been published successfully.\n\nTrack remote endpoint changes separately so that float notification and\ntransport-address rehashing remain limited to actual peer floats.","state":0,"publishedAt":"2026-10-18T15:19:17.227+00:00","modifiedAt":"2026-10-19T09:22:31.48+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ovpn/peer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f0281c1d3732d1ec084fa1e06d1767d33e1a570e\",\n                            \"lessThan\": \"21dbc9f4d0bdd3b22f91beabc7840064bf11594f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0281c1d3732d1ec084fa1e06d1767d33e1a570e\",\n                            \"lessThan\": \"e283009151d3d131447c2edda500199c5fda5f72\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0281c1d3732d1ec084fa1e06d1767d33e1a570e\",\n                            \"lessThan\": \"aea934a221ec6a867221e5b765f65f1857befd53\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ovpn/peer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/21dbc9f4d0bdd3b22f91beabc7840064bf11594f","https://git.kernel.org/stable/c/e283009151d3d131447c2edda500199c5fda5f72","https://git.kernel.org/stable/c/aea934a221ec6a867221e5b765f65f1857befd53"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98604","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98604","identifiers":["CVE-2026-98604"]},"retained":false,"historicalAffected":[]}],"coverage":[]}