CVE-2026-97939

Received Received - Intake

Memory Accounting Bypass in Linux Kernel Multicast Routing

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen id allocates an mr_table via the shared mr_table_alloc(), links it into the per-net list, and leaves it until netns teardown. Those objects were not charged to memcg, so the host unreclaimable slab grows with the table count. Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established handling of IP addresses, routes and alternate interface names. Unresolved MFC entries are still allocated from softIRQ with GFP_ATOMIC and are not charged. They expire after 10 seconds and are bounded by the socket receive queue; see commit 0079ad8e8dc3 ("ipmr: remove hard code cache_resolve_queue_len limit").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97939

EUVD

EUVD-2026-86793

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a user with network namespace privileges to create many IPv4 and IPv6 multicast routing tables. Each table allocates memory that is not tracked by memory control groups (memcg), causing the host's unreclaimable slab memory to grow without bound until the network namespace is destroyed.

Detection Guidance

This vulnerability involves unaccounted memory growth in the Linux kernel's multicast routing tables due to improper slab memory charging. Detection requires monitoring slab memory usage for mr_table objects and multicast routing table allocations. Check for increasing unreclaimable slab memory in the host using commands like 'cat /proc/meminfo | grep Slab' or 'slabtop'. Monitor netns-specific allocations with 'ip netns list' and inspect per-netns multicast tables using 'ip mroute show'. High memory usage without corresponding memcg charges may indicate exploitation.

Impact Analysis

An attacker with network namespace access could exhaust system memory by creating many multicast routing tables, leading to denial of service or system instability. This affects systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability primarily causes memory leaks in the Linux kernel's multicast routing tables, leading to unreclaimable slab growth. It does not directly impact data privacy or security controls required by GDPR or HIPAA. However, unchecked memory exhaustion could indirectly affect system availability, potentially violating service level agreements or operational requirements in regulated environments.

Mitigation Strategies

Apply the kernel patch that accounts mr_table allocations with GFP_KERNEL_ACCOUNT and marks IPv4/IPv6 MFC caches with SLAB_ACCOUNT. Update to a kernel version containing the fix (commit referenced in description). Monitor memory usage post-patch to ensure slab growth stabilizes. If immediate patching is not possible, restrict untrusted users from creating net namespaces or multicast routing tables via kernel parameter adjustments or container isolation.

Hi! I’m here to help you understand CVE-2026-97939. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70