{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97597 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97597 is a denial of service vulnerability in Linux, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97597 and fix it if it is affected.\n\nWhat it is: CVE-2026-97597 is a denial of service vulnerability in Linux, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97597 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97597/ (Markdown: https://insights.sbomify.com/CVE-2026-97597/index.md)","id":"CVE-2026-97597","markdown":"https://insights.sbomify.com/CVE-2026-97597/index.md","name":"CVE-2026-97597","record":{"aliases":["AZL-104370","BELL-CVE-2026-97597","DEBIAN-CVE-2026-97597","GHSA-7x5f-23mf-qfp3","UBUNTU-CVE-2026-97597"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An unprivileged local user can exhaust kernel memory by repeatedly requesting IPv6 flow labels, causing a denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: flowlabel: cap duplicate leases per socket\n\nipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every\nsuccessful GET. The recheck path for a compatible existing flowlabel\nlinks another lease without applying any lease admission check. Repeated\nGET requests for one shareable label can therefore grow a socket's lease\nlist without bound.\n\nReject a new unprivileged lease once the socket already holds\nFL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse\nof a globally interned label, including the fl_intern() collision path,\nis covered as well. New-label admission remains under the existing\nmem_check() policy.\n\nUse capable(CAP_NET_ADMIN) rather than ns_capable(), matching\nmem_check(). An unprivileged user must not bypass the cap by creating a\nuser namespace and a netns where they have CAP_NET_ADMIN, which would\nstill consume host memory.\n\nCheck the capability only when the socket reaches the limit, so\nsuccessful unprivileged GET requests below the cap do not generate a\ncapability audit. Do the admission check before updating linger and\nexpires so a rejected GET does not refresh the shared label, matching\nthe existing socket-list allocation failure path.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ipv6: flowlabel: cap duplicate leases per socket","id":"CVE-2026-97597","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ipv4: fib: bound automatic table ID allocation","id":"CVE-2026-97598"},"packages":[],"prev":{"headline":"ipvs: reject invalid states in connection template sync records","id":"CVE-2026-97596"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"An unprivileged local user can exhaust kernel memory by repeatedly requesting IPv6 flow labels, causing a denial of service.","url":"https://insights.sbomify.com/CVE-2026-97597/"}