HIGH Introduced in 6.16
ovpn LocalEndpoint Race
CVE-2026-98604
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published through peer->bind with RCU, but local endpoint learning updates bind->local in place under peer->lock. UDP TX reads the field without that lock. In particular, a concurrent IPv6 update can therefore result in a torn address read. Use ovpn_peer_reset_sockaddr to publish a replacement bind when learning a new local endpoint, just as a remote endpoint change does. Preserve the current remote address and reset the dst cache only after the new bind has been published successfully. Track remote endpoint changes separately so that float notification and transport-address rehashing remain limited to actual peer floats.
02KernelScan AI Analysis
Risk summary
A race condition in the OpenVPN kernel module allows a remote attacker to trigger a torn read of an IPv6 address by sending crafted UDP packets to an active OpenVPN tunnel. This can leak partial address information, cause packet misrouting, and potentially lead to kernel instability or crashes.
Vulnerability analysis
The OpenVPN kernel module publishes its UDP socket binding (struct ovpn_bind) via RCU for lockless reads in the transmit path. When learning a new local endpoint from incoming packets, the original code updated the bind->local field in-place while holding peer->lock, but the UDP transmit path reads this field without that lock—only RCU protection. On 64-bit systems, a 128-bit IPv6 address read is not atomic, so a concurrent update can cause the transmitter to see a torn address (half old, half new). The fix replaces the in-place update with a full bind replacement using ovpn_peer_reset_sockaddr(), which publishes a new ovpn_bind structure atomically via RCU, ensuring readers always observe a consistent address. The dst cache is reset only after the new bind is successfully published, and remote-endpoint changes are tracked separately to limit float notifications. An attacker on the network path who can inject or spoof OpenVPN UDP packets toward an active tunnel can trigger this race; no local privileges or user interaction are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.55 | 21dbc9f4d0bd |
| 7.2 | 6.16 | 7.2.9 | e283009151d3 |
| mainline | 6.16 | 7.3 | aea934a221ec |