CVE-2026-98603: Linux kernel · ovpn: replace bind when clearing stale local source
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in c44a04722f7dae9a45a101b8e100931ab59f1c18 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 12:55 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in c44a04722f7dae9a45a101b8e100931ab59f1c18, 72bd1bea37ea2c8553938f086bf48ccd2147dfe1, 7d8104988f423572df1f3347ce578037b1043f34
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to c44a04722f7dae9a45a101b8e100931ab59f1c18, 72bd1bea37ea2c8553938f086bf48ccd2147dfe1 or 7d8104988f423572df1f3347ce578037b1043f34.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel commits identified by hashes c44a04722f7dae9a45a101b8e100931ab59f1c18, 72bd1bea37ea2c8553938f086bf48ccd2147dfe1, and 7d8104988f423572df1f3347ce578037b1043f34. Users should update to the fixed Linux kernel version 6.16 or later containing these patches to remediate the issue.
Description
A vulnerability in the Linux kernel's ovpn module related to clearing stale local source addresses in UDP output fallback has been resolved. The issue involved modifying a bind structure that is read locklessly by concurrent transmissions, which could cause torn IPv6 addresses to be observed. The fix involves retrying route lookups without modifying the bind, revalidating under lock, resetting caches, and publishing a replacement bind with a wildcard address. This prevents inconsistent state and cache invalidation issues.