In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published… (CVE-2026-98604)

The Linux kernel ovpn module had a concurrency issue where struct ovpn_bind was updated in place under a lock, but UDP transmission read the local endpoint address without that lock. This could cause torn reads of IPv6 addresses during concurrent updates. The vulnerability was addressed by changing the implementation to publish a replacement bind structure when learning a new local endpoint, using ovpn_peer_reset_sockaddr, preserving the remote address, and resetting the destination cache only after successful publication. Remote endpoint changes are tracked separately to limit unnecessary notifications and rehashing.

The vulnerability could lead to inconsistent or torn reads of IPv6 local endpoint addresses during concurrent updates in the ovpn kernel module. This may cause incorrect behavior in UDP transmission related to the local endpoint. No information about exploitation in the wild is available.

A fix has been implemented in the Linux kernel ovpn module that replaces the bind structure when learning a new local endpoint, ensuring safe concurrent access. Users should update to the patched kernel version containing this fix. No additional mitigation steps are indicated.