{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97597", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.157Z", "datePublished": "2026-09-25T10:22:12.378Z", "dateUpdated": "2026-09-25T10:22:12.378Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T10:22:12.378Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: flowlabel: cap duplicate leases per socket\n\nipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every\nsuccessful GET. The recheck path for a compatible existing flowlabel\nlinks another lease without applying any lease admission check. Repeated\nGET requests for one shareable label can therefore grow a socket's lease\nlist without bound.\n\nReject a new unprivileged lease once the socket already holds\nFL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse\nof a globally interned label, including the fl_intern() collision path,\nis covered as well. New-label admission remains under the existing\nmem_check() policy.\n\nUse capable(CAP_NET_ADMIN) rather than ns_capable(), matching\nmem_check(). An unprivileged user must not bypass the cap by creating a\nuser namespace and a netns where they have CAP_NET_ADMIN, which would\nstill consume host memory.\n\nCheck the capability only when the socket reaches the limit, so\nsuccessful unprivileged GET requests below the cap do not generate a\ncapability audit. Do the admission check before updating linger and\nexpires so a rejected GET does not refresh the shared label, matching\nthe existing socket-list allocation failure path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/ip6_flowlabel.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2f1a6dd5c80ceb902f50449efe899f29cd7918e3", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "467467bf4209f9f8add0c648bae763f92a0224c3", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8d6cd188508513503805c156165de38e4e4a8615", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/ip6_flowlabel.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2f1a6dd5c80ceb902f50449efe899f29cd7918e3"}, {"url": "https://git.kernel.org/stable/c/467467bf4209f9f8add0c648bae763f92a0224c3"}, {"url": "https://git.kernel.org/stable/c/8d6cd188508513503805c156165de38e4e4a8615"}], "title": "ipv6: flowlabel: cap duplicate leases per socket", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/ip6_flowlabel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2f1a6dd5c80ceb902f50449efe899f29cd7918e3", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "467467bf4209f9f8add0c648bae763f92a0224c3", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "8d6cd188508513503805c156165de38e4e4a8615", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/ip6_flowlabel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: flowlabel: cap duplicate leases per socket\n\nipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every\nsuccessful GET. The recheck path for a compatible existing flowlabel\nlinks another lease without applying any lease admission check. Repeated\nGET requests for one shareable label can therefore grow a socket's lease\nlist without bound.\n\nReject a new unprivileged lease once the socket already holds\nFL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse\nof a globally interned label, including the fl_intern() collision path,\nis covered as well. New-label admission remains under the existing\nmem_check() policy.\n\nUse capable(CAP_NET_ADMIN) rather than ns_capable(), matching\nmem_check(). An unprivileged user must not bypass the cap by creating a\nuser namespace and a netns where they have CAP_NET_ADMIN, which would\nstill consume host memory.\n\nCheck the capability only when the socket reaches the limit, so\nsuccessful unprivileged GET requests below the cap do not generate a\ncapability audit. Do the admission check before updating linger and\nexpires so a rejected GET does not refresh the shared label, matching\nthe existing socket-list allocation failure path."}], "id": "CVE-2026-97597", "lastModified": "2026-09-25T11:17:11.017", "metrics": {}, "published": "2026-09-25T11:17:11.017", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f1a6dd5c80ceb902f50449efe899f29cd7918e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/467467bf4209f9f8add0c648bae763f92a0224c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d6cd188508513503805c156165de38e4e4a8615"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2f1a6dd5c80ceb902f50449efe899f29cd7918e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,467467bf4209f9f8add0c648bae763f92a0224c3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8d6cd188508513503805c156165de38e4e4a8615)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:45:18.891637+00:00", "updated": "2026-09-25T17:45:17.055742+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-400", "CWE-770"]}