All vulnerabilities
CVE-2026-97597

Linux: ipv6: flowlabel: cap duplicate leases per socket

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0159f716d8adbe85951cdf008d0afe27d874eaa6Also 6d917992c22b6029fc2dc1bd464b7f6709357161, 2f1a6dd5c80ceb902f50449efe899f29cd7918e3 and 2 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0159f716d8adbe85951cdf008d0afe27d874eaa6LinuxCVE List
  • 6d917992c22b6029fc2dc1bd464b7f6709357161LinuxCVE List
  • 2f1a6dd5c80ceb902f50449efe899f29cd7918e3LinuxCVE List
  • 467467bf4209f9f8add0c648bae763f92a0224c3LinuxCVE List
  • 8d6cd188508513503805c156165de38e4e4a8615LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: flowlabel: cap duplicate leases per socket

ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease admission check. Repeated GET requests for one shareable label can therefore grow a socket's lease list without bound.

Reject a new unprivileged lease once the socket already holds FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse of a globally interned label, including the fl_intern() collision path, is covered as well. New-label admission remains under the existing mem_check() policy.

Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching mem_check(). An unprivileged user must not bypass the cap by creating a user namespace and a netns where they have CAP_NET_ADMIN, which would still consume host memory.

Check the capability only when the socket reaches the limit, so successful unprivileged GET requests below the cap do not generate a capability audit. Do the admission check before updating linger and expires so a rejected GET does not refresh the shared label, matching the existing socket-list allocation failure path.

Text from CVE List

Affected versions 12

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 0159f716d8adbe85951cdf008d0afe27d874eaa6CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6d917992c22b6029fc2dc1bd464b7f6709357161CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2f1a6dd5c80ceb902f50449efe899f29cd7918e3CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 467467bf4209f9f8add0c648bae763f92a0224c3CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8d6cd188508513503805c156165de38e4e4a8615CVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5