CVE-2026-97597

CVE CVE-2026-97597EUVD EUVD-2026-86728Published 2026-09-25T10:22:12.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease admission check. Repeated GET requests for one shareable label can therefore grow a socket's lease list without bound. Reject a new unprivileged lease once the socket already holds FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse of a globally interned label, including the fl_intern() collision path, is covered as well. New-label admission remains under the existing mem_check() policy. Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching mem_check(). An unprivileged user must not bypass the cap by creating a user namespace and a netns where they have CAP_NET_ADMIN, which would still consume host memory. Check the capability only when the socket reaches the limit, so successful unprivileged GET requests below the cap do not generate a capability audit. Do the admission check before updating linger and expires so a rejected GET does not refresh the shared label, matching the existing socket-list allocation failure path.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.18.53; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8d6cd188508513503805c156165de38e4e4a8615; patch: 0; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2f1a6dd5c80ceb902f50449efe899f29cd7918e3; patch: 7.3-rc3; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <467467bf4209f9f8add0c648bae763f92a0224c3; patch: 7.2.7; 2.6.12

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.