CVE-2026-97602

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: invalidate queues before flushing them

fqdir_pre_exit() flushes the skbs from incomplete queues without

changing their completion state. A fragment which found a queue before

high_thresh was cleared can then acquire the queue lock and reuse stale

reassembly metadata. A queue concurrently killed after fqdir->dead is

set can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while

still holding its old skbs; skipping it because it is complete leaves

those references behind until asynchronous fqdir teardown.

For IPv6, stale metadata can make ip6_frag_reasm() use the old

nhoffset with a new skb and access memory out of bounds. The resulting

heap corruption can be leveraged for local privilege escalation when

unprivileged network namespaces are available. Unflushed fragments can

also keep conntrack references alive after the conntrack per-net

cleanup point.

Kill each incomplete queue, then flush every qu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References