CVE-2026-98604: Linux Kernel Race Condition Vulnerability

CVE-2026-98604 Overview

CVE-2026-98604 is a Linux kernel vulnerability in the OpenVPN data channel offload (ovpn) subsystem. The flaw involves a race condition when the kernel learns a new local endpoint for an active VPN peer. The struct ovpn_bind structure is published through peer->bind using Read-Copy-Update (RCU), but local endpoint learning mutated bind->local in place while only holding peer->lock. UDP transmit paths read the same field without that lock, allowing a concurrent IPv6 update to produce a torn address read. The upstream fix replaces the bind atomically instead of modifying it in place.

Critical Impact
A concurrent IPv6 local endpoint update can cause the UDP transmit path to observe a partially written address, resulting in misrouted VPN traffic or kernel memory corruption on affected systems.

Affected Products

Linux kernel versions containing the ovpn (OpenVPN data channel offload) module prior to the fix commits
Distributions shipping affected mainline and stable kernel branches
Systems using in-kernel OpenVPN acceleration with dynamic local endpoint learning

Discovery Timeline

2026-10-18 - CVE-2026-98604 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98604

Vulnerability Analysis

The ovpn kernel module manages per-peer transport state in struct ovpn_bind, which holds the local and remote socket addresses used for UDP transmission. The structure is published to readers using RCU, so UDP transmit paths dereference peer->bind without acquiring peer->lock. When the kernel learned a new local endpoint, it wrote the updated address directly into bind->local while holding only peer->lock. Readers on the TX path therefore observed the field without synchronization. For IPv6 addresses, which span multiple machine words, this created a window where a reader could consume a mixture of old and new bytes. The resulting torn address could point to invalid memory or an unintended destination.

Root Cause

The root cause is inconsistent synchronization between RCU publishers and lock-only writers on the same field. The bind->local member was mutated in place under a spinlock while concurrent lockless readers relied on RCU semantics. This mismatch between the publication model (RCU) and the update model (in-place write) violates the invariant that RCU-published objects must be immutable after publication.

Attack Vector

Triggering the condition requires an active ovpn peer that experiences a local endpoint change concurrent with outbound traffic. Local endpoint learning is driven by received packets, so an attacker able to influence inbound packet routing can increase the frequency of local endpoint updates. Combined with sustained outbound VPN traffic, this maximizes the window for a torn read. The impact ranges from dropped or misdirected packets to kernel instability if the torn address is dereferenced. Full exploitability for arbitrary code execution has not been demonstrated.

See the upstream fixes for implementation detail: Kernel Git Commit 21dbc9f, Kernel Git Commit aea934a, and Kernel Git Commit e2830091.

Detection Methods for CVE-2026-98604

Indicators of Compromise

Kernel log entries referencing the ovpn module alongside unexpected UDP transmit errors or address family mismatches.
Anomalous VPN packet drops or misrouted traffic correlated with changes in client source address or network path.
Kernel oops or warning traces in the UDP IPv6 send path when the ovpn module is loaded.

Detection Strategies

Inventory running kernels across Linux fleets and compare build versions against the three upstream fix commits.
Monitor loaded kernel modules for ovpn on systems that do not require OpenVPN data channel offload.
Correlate VPN session instability with recent client network changes that would trigger local endpoint relearning.

Monitoring Recommendations

Forward kernel ring buffer and journald events to a central log store and alert on ovpn warnings or UDP6 send failures.
Track kernel package versions through configuration management and flag hosts missing the stable fix.
Baseline normal VPN peer float frequency and alert on sustained anomalies.

How to Mitigate CVE-2026-98604

Immediate Actions Required

Apply the Linux stable kernel update that contains the three referenced commits as soon as the vendor publishes it for your distribution.
Reboot affected hosts after kernel installation to activate the fixed ovpn module.
If the fix is not yet available, restrict exposure of VPN endpoints to trusted network segments.

Patch Information

The upstream resolution replaces the ovpn_bind structure through ovpn_peer_reset_sockaddr when learning a new local endpoint, mirroring the handling of remote endpoint changes. The patch preserves the current remote address, resets the destination cache only after the new bind is published, and separates remote float tracking so that float notifications and transport-address rehashing fire only on genuine peer floats. Fixes are available in the stable tree via commits 21dbc9f4d0bd, aea934a221ec, and e283009151d3.

Workarounds

Unload the ovpn kernel module on hosts that do not require it and use userspace OpenVPN as an interim measure.
Pin VPN clients to stable network paths to reduce local endpoint relearning events until patching completes.
Disable IPv6 transport for OpenVPN peers where feasible, since the torn read window is widest for IPv6 addresses.

bash

# Verify the ovpn module status and current kernel version
uname -r
lsmod | grep -w ovpn

# Temporarily unload the module if not required
sudo modprobe -r ovpn

# Blacklist until a patched kernel is deployed
echo 'blacklist ovpn' | sudo tee /etc/modprobe.d/disable-ovpn.conf
sudo update-initramfs -u