CVE-2026-97597
Received Received - Intake

IPv6 Flowlabel Lease Limit Bypass in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease admission check. Repeated GET requests for one shareable label can therefore grow a socket's lease list without bound. Reject a new unprivileged lease once the socket already holds FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse of a globally interned label, including the fl_intern() collision path, is covered as well. New-label admission remains under the existing mem_check() policy. Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching mem_check(). An unprivileged user must not bypass the cap by creating a user namespace and a netns where they have CAP_NET_ADMIN, which would still consume host memory. Check the capability only when the socket reaches the limit, so successful unprivileged GET requests below the cap do not generate a capability audit. Do the admission check before updating linger and expires so a rejected GET does not refresh the shared label, matching the existing socket-list allocation failure path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97597
EUVD
EUVD-2026-86728

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel allows unprivileged users to repeatedly request IPv6 flow labels, causing unbounded growth of a socket's lease list. The issue occurs because the recheck path for existing flow labels does not enforce lease admission limits, allowing memory exhaustion.

Detection Guidance

This vulnerability involves unbounded growth of ipv6_fl_socklist entries due to repeated GET requests for shareable flowlabels. Detection requires checking kernel logs for excessive flowlabel allocations or socket leaks. Monitor for processes making frequent ipv6_flowlabel_get() calls or unusual memory growth in network-related kernel structures. Use commands like 'dmesg | grep flowlabel' or 'ss -tulnp' to inspect network sockets and kernel logs for anomalies.

Impact Analysis

An attacker could exploit this to consume excessive memory on a system by repeatedly requesting flow labels, potentially leading to denial-of-service conditions or system crashes due to resource exhaustion.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Restrict unprivileged users from creating network namespaces or manipulating flowlabels. Monitor systems for processes repeatedly requesting flowlabels. Update ipv6 subsystem configurations to enforce lease limits. Consider disabling IPv6 flowlabel features if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97597. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart