All vulnerabilities
CVE-2026-97939

Linux: ipmr: account multicast table and route memory

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in21e0749e8ef272ac7e3eefe0fa488a5983f4b038Also 0264b3ee09b118fec8a5471b4ca288f8ab84722fCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 21e0749e8ef272ac7e3eefe0fa488a5983f4b038LinuxCVE List
  • 0264b3ee09b118fec8a5471b4ca288f8ab84722fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmr: account multicast table and route memory

A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen id allocates an mr_table via the shared mr_table_alloc(), links it into the per-net list, and leaves it until netns teardown. Those objects were not charged to memcg, so the host unreclaimable slab grows with the table count.

Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established handling of IP addresses, routes and alternate interface names.

Unresolved MFC entries are still allocated from softIRQ with GFP_ATOMIC and are not charged. They expire after 10 seconds and are bounded by the socket receive queue; see commit 0079ad8e8dc3 ("ipmr: remove hard code cache_resolve_queue_len limit").

Text from CVE List

Affected versions 12

  • Linuxaffected: f0ad0860d01e47a3ffd220564c5c653b3afbe962 before 21e0749e8ef272ac7e3eefe0fa488a5983f4b038CVE List
  • Linuxaffected: f0ad0860d01e47a3ffd220564c5c653b3afbe962 before ec1c6140394ee87127479bc500a3158b125bf07aCVE List
  • Linuxaffected: f0ad0860d01e47a3ffd220564c5c653b3afbe962 before 0264b3ee09b118fec8a5471b4ca288f8ab84722fCVE List
  • Linuxaffected: f0ad0860d01e47a3ffd220564c5c653b3afbe962 before d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1cCVE List
  • Linuxaffected: f0ad0860d01e47a3ffd220564c5c653b3afbe962 before b7ee18725f2292ab554aa96a101ae42d45f008bdCVE List
  • Linuxaffected: 2.6.35CVE List
  • Linuxunaffected: all versions before 2.6.35CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5