CVE-2026-97597 ipv6: flowlabel: cap duplicate leases per socket
An unprivileged local user can exhaust kernel memory by repeatedly requesting IPv6 flow labels, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97597?
CVE-2026-97597 is a denial of service vulnerability in Linux, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: flowlabel: cap duplicate leases per socket
ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease admission check. Repeated GET requests for one shareable label can therefore grow a socket's lease list without bound.
Reject a new unprivileged lease once the socket already holds FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse of a globally interned label, including the fl_intern() collision path, is covered as well. New-label admission remains under the existing mem_check() policy.
Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching mem_check(). An unprivileged user must not bypass the cap by creating a user namespace and a netns where they have CAP_NET_ADMIN, which would still consume host memory.
Check the capability only when the socket reaches the limit, so successful unprivileged GET requests below the cap do not generate a capability audit. Do the admission check before updating linger and expires so a rejected GET does not refresh the shared label, matching the existing socket-list allocation failure path.
Which versions are affected by CVE-2026-97597?
How do I fix CVE-2026-97597?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97597 being exploited?
There is no known exploitation of CVE-2026-97597 in the wild and no public exploit code.
Sources
Also known as AZL-104370, BELL-CVE-2026-97597, DEBIAN-CVE-2026-97597, GHSA-7x5f-23mf-qfp3, UBUNTU-CVE-2026-97597.