In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback… (CVE-2026-98603)

The Linux kernel vulnerability CVE-2026-98603 concerns the ovpn UDP output fallback clearing bind->local in place when the remembered source address is stale. Because the bind structure is RCU-published and read locklessly by concurrent transmissions, an IPv6 reader could observe a torn address, leading to potential inconsistencies. The fix involves retrying route lookup with source address autoselection without modifying the bind, revalidating the bind and route key under a lock, resetting the destination cache, and publishing a replacement bind with a wildcard local address. The patch also avoids caching the resolved destination when clearing the local source to prevent invalidation issues with per-CPU cache entries.

The vulnerability could cause inconsistent or torn IPv6 source addresses to be observed during concurrent transmissions, potentially leading to routing or communication errors in the ovpn UDP output fallback path. No information about exploitation or broader impact is provided.

A fix has been implemented in the Linux kernel to address this issue. Users should apply the official kernel updates that include this patch. No additional mitigation steps are indicated.