{"cve":"CVE-2026-97597","nvd":{"published":"2026-09-25T11:17:11.017","modified":"2026-10-21T13:21:14.457","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: flowlabel: cap duplicate leases per socket\n\nipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every\nsuccessful GET. The recheck path for a compatible existing flowlabel\nlinks another lease without applying any lease admission check. Repeated\nGET requests for one shareable label can therefore grow a socket's lease\nlist without bound.\n\nReject a new unprivileged lease once the socket already holds\nFL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse\nof a globally interned label, including the fl_intern() collision path,\nis covered as well. New-label admission remains under the existing\nmem_check() policy.\n\nUse capable(CAP_NET_ADMIN) rather than ns_capable(), matching\nmem_check(). An unprivileged user must not bypass the cap by creating a\nuser namespace and a netns where they have CAP_NET_ADMIN, which would\nstill consume host memory.\n\nCheck the capability only when the socket reaches the limit, so\nsuccessful unprivileged GET requests below the cap do not generate a\ncapability audit. Do the admission check before updating linger and\nexpires so a rejected GET does not refresh the shared label, matching\nthe existing socket-list allocation failure path.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0159f716d8adbe85951cdf008d0afe27d874eaa6","https://git.kernel.org/stable/c/2f1a6dd5c80ceb902f50449efe899f29cd7918e3","https://git.kernel.org/stable/c/467467bf4209f9f8add0c648bae763f92a0224c3","https://git.kernel.org/stable/c/6d917992c22b6029fc2dc1bd464b7f6709357161","https://git.kernel.org/stable/c/8d6cd188508513503805c156165de38e4e4a8615"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-97597","score":0.00217,"percentile":0.12002,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}