CVE-2026-98603ovpn: replace bind when clearing stale local source
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind->local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an IPv6 reader can observe a torn address. Retry the route lookup with source address autoselection without modifying the bind. After a successful lookup, revalidate the bind and route key under peer->lock, reset the dst cache, and best-effort publish a replacement bind with a wildcard local address. Do not cache the resolved dst when clearing the local source. Replacing the source invalidates all per-CPU cache entries, while dst_cache_set_ip4 and dst_cache_set_ip6 update only the current CPU slot. The current packet can still use the resolved route; if bind allocation fails, a later cache miss retries the repair.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 08857b5ec5d91d83e69e40a36554a8c7557b7301 before c44a04722f7dae9a45a101b8e100931ab59f1c18; 08857b5ec5d91d83e69e40a36554a8c7557b7301 builds before 72bd1bea37ea2c8553938f086bf48ccd2147dfe1; 08857b5ec5d91d83e69e40a36554a8c7557b7301 builds before 7d8104988f423572df1f3347ce578037b1043f34 | CNA record |
References
- https://git.kernel.org/stable/c/c44a04722f7dae9a45a101b8e100931ab59f1c18
- https://git.kernel.org/stable/c/72bd1bea37ea2c8553938f086bf48ccd2147dfe1
- https://git.kernel.org/stable/c/7d8104988f423572df1f3347ce578037b1043f34
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.