CVE-2026-97939

ipmr: account multicast table and route memory

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmr: account multicast table and route memory

A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen id allocates an mr_table via the shared mr_table_alloc(), links it into the per-net list, and leaves it until netns teardown. Those objects were not charged to memcg, so the host unreclaimable slab grows with the table count.

Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established handling of IP addresses, routes and alternate interface names.

Unresolved MFC entries are still allocated from softIRQ with GFP_ATOMIC and are not charged. They expire after 10 seconds and are bounded by the socket receive queue; see commit 0079ad8e8dc3 ("ipmr: remove hard code cache_resolve_queue_len limit").

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 3e808d8dfebd8f114a747bd90c8f7d2a6fd7474fAffected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 57c523e95ea2608a19e6bfcd664d641ddf7bc4b4Affected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 20424f267c9dbdfcade28b2b2306767a7dfb43d1Affected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 21e0749e8ef272ac7e3eefe0fa488a5983f4b038Affected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before ec1c6140394ee87127479bc500a3158b125bf07aAffected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 0264b3ee09b118fec8a5471b4ca288f8ab84722fAffected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1cAffected f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before b7ee18725f2292ab554aa96a101ae42d45f008bdAffected
LinuxLinux	2.6.35Affected before 2.6.35Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 3e808d8dfebd8f114a747bd90c8f7d2a6fd7474fAffected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 57c523e95ea2608a19e6bfcd664d641ddf7bc4b4Affected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 20424f267c9dbdfcade28b2b2306767a7dfb43d1Affected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 21e0749e8ef272ac7e3eefe0fa488a5983f4b038Affected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before ec1c6140394ee87127479bc500a3158b125bf07aAffected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before 0264b3ee09b118fec8a5471b4ca288f8ab84722fAffected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1cAffected
f0ad0860d01e47a3ffd220564c5c653b3afbe962 to before b7ee18725f2292ab554aa96a101ae42d45f008bdAffected

LinuxLinux

2.6.35Affected
before 2.6.35Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.