CVE-2026-97597

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: flowlabel: cap duplicate leases per socket

ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every

successful GET. The recheck path for a compatible existing flowlabel

links another lease without applying any lease admission check. Repeated

GET requests for one shareable label can therefore grow a socket's lease

list without bound.

Reject a new unprivileged lease once the socket already holds

FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse

of a globally interned label, including the fl_intern() collision path,

is covered as well. New-label admission remains under the existing

mem_check() policy.

Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching

mem_check(). An unprivileged user must not bypass the cap by creating a

user namespace and a netns where they have CAP_NET_ADMIN, which would

still consume host memory.

Check the capability only when the socket reaches the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References