CVE-2026-97597

Executive Summary

CVE-2026-97597 is a resource-exhaustion flaw in the Linux kernel IPv6 flow label implementation. ipv6_flowlabel_get() allocates a lease entry for every successful GET request, and the compatible-label "recheck" path links additional leases without any admission check, allowing an unprivileged local user to grow a socket's lease list without bound. The fix caps unprivileged leases at FL_MAX_PER_SOCK, reducing the issue from unbounded to bounded kernel memory consumption attributable to the requesting socket.

Technical Analysis

The affected component is the IPv6 flow label subsystem in the Linux kernel, reached through the socket flow-label lookup path (ipv6_flowlabel_get()). Flow labels can be shared between multiple sockets, and the kernel tracks such sharing by linking additional ipv6_fl_socklist entries onto a socket's lease list. Every successful GET allocates such an entry.

The defect described is an admission-control gap on the reuse path. When a socket requests a flow label that already exists and is compatible, the "recheck" path links another lease onto the socket without applying any per-socket lease limit. The fl_intern() collision path — reuse of a globally interned label — is likewise uncovered. Consequently, repeated GET requests for a single shareable label cause the socket's lease list to grow without bound. The neighboring mem_check() policy governs admission of new labels, but does not bound duplicate leases against an existing shareable label.

This is a local, unprivileged reachable condition: any process able to issue the relevant flow-label requests can drive allocation growth. The fix rejects a new unprivileged lease once the socket already holds FL_MAX_PER_SOCK leases, applying the check on the shared recheck path so both normal reuse and the fl_intern() collision path are covered. New-label admission continues to be governed by mem_check().

Two implementation notes from the fix are operationally relevant. First, the capability check uses capable(CAP_NET_ADMIN) rather than ns_capable(), deliberately preventing an unprivileged user from bypassing the limit by creating a user namespace plus a network namespace in which they hold CAP_NET_ADMIN — an escape that would still consume host memory. Second, the capability is checked only once the socket reaches the limit, so successful unprivileged GETs below the cap do not generate capability audit records. The admission check is performed before updating linger and expiry so that a rejected GET does not refresh the shared label, mirroring the existing socket-list allocation failure path.

Because the flaw is an unbounded allocation driven by repeated local requests, its security relevance is denial of service and resource exhaustion rather than confidentiality or integrity compromise. No exploit code, PoC, or Nuclei template is available for this CVE, and no EPSS score has been published by FIRST.org.

Exploitation Scenarios

No public proof of concept exists for CVE-2026-97597; the following chain is inferred from the vulnerability class (unbounded resource allocation reachable by an unprivileged local user) and from the mechanism stated in the NVD description.

1. Reconnaissance / target identification. The attacker requires local execution context on a Linux host and the ability to open or operate an IPv6-capable socket through which flow-label requests can be issued. Confirmation that the target kernel predates the FL_MAX_PER_SOCK admission check establishes the exposure. No remote reconnaissance is applicable because the flaw is not remotely triggerable per available data.

2. Triggering the flaw class. The attacker repeatedly issues successful flow-label GET requests against a shareable existing label. On each hit, the reuse/recheck path — including the fl_intern() collision path — links an additional ipv6_fl_socklist entry onto the requesting socket's lease list. Because that path applies no lease admission check, and because mem_check() governs only new-label admission, the list grows without a per-socket cap.

3. Execution method. This is a logic/state-manipulation attack at the system-call and socket-option level rather than an injection or memory-corruption exploit. The attacker loops the GET operation, optionally across concurrent threads, to accumulate leases. Following the fix's logic, the intended bypass that would have defeated a namespace-scoped capability check — creating a user namespace and network namespace to obtain CAP_NET_ADMIN and still consume host memory — no longer succeeds against capable(CAP_NET_ADMIN), but on an unpatched host the absence of any cap check at all means no privilege is required.

4. Post-exploitation impact. Sustained accumulation of lease records consumes kernel memory and, where the underlying label structure is shared, manipulates per-label bookkeeping (linger/expiry refresh on repeated GET). The primary outcome is local denial of service and memory pressure on the affected host; the description does not indicate privilege escalation, code execution, or data disclosure. An attacker with a foothold could degrade availability or contribute to broader memory-exhaustion conditions on multi-tenant or container hosts.

Impact Assessment

The impact is availability-focused. An unprivileged local user can cause unbounded growth of kernel memory tied to a socket's flow-label lease list, producing local denial of service and memory pressure. A CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is used here to reflect local attack vector, low complexity, low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. This vector is analyst-derived; the authoritative score is not published (NVD lists CVSS as N/A).

Affected systems are Linux hosts with IPv6 flow-label support reachable by unprivileged local processes, including shared, containerized, and multi-tenant environments where many unprivileged workloads share a single kernel. Blast radius is host- or node-scoped: successful exhaustion degrades or destabilizes the kernel for all workloads on that host, but does not cross trust boundaries to other hosts through this flaw alone. CISA KEV status is NO, no EPSS score exists, and no affected version list, OSV package data, or vendor advisory is available from tracked sources.

Detection Guidance

Sigma Rule

title: Repeated IPv6 Flow Label Lease Requests by Single Process (CVE-2026-97597)
id: 9f2c1b74-3a6e-4d51-8b0c-7e5a1d9f2c33
status: experimental
description: Detects high-frequency IPv6 flow label GET activity from one process, consistent with unbounded lease accumulation (CVE-2026-97597).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97597
author: valtersit.com
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall:
      - 'setsockopt'
      - 'sendmsg'
  timeframe: 60s
  condition: selection | count() by exe > 500
fields:
  - exe
  - pid
  - uid
  - syscall
falsepositives:
  - Legitimate network services issuing many IPv6 flow label operations
level: medium
tags:
  - attack.t1499
  - cve.2026.97597

YARA Rule

rule CVE_2026_97597_IPv6_Flowlabel_Lease_Exhaustion
{
    meta:
        description = "Detects binaries or scripts that repeatedly exercise IPv6 flow label lease allocation consistent with CVE-2026-97597"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97597"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fl1 = "IPV6_FLOWLABEL_MGR" ascii wide
        $fl2 = "IPV6_FLOWINFO_SEND" ascii wide
        $fl3 = "ipv6_flowlabel_get" ascii wide
        $fl4 = "FL_MAX_PER_SOCK" ascii wide
        $opt = "IPV6_FLOWLABEL_MGR" ascii

    condition:
        uint32(0) == 0x464c457f and
        (any of ($fl1, $fl2, $fl3, $fl4)) and
        filesize < 5MB
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-97597 - Suspected IPv6 flow label lease exhaustion burst"; flow:stateless; threshold: type both, track by_src, count 500, seconds 60; classtype:attempted-dos; reference:cve,2026-97597; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97597; sid:202697597; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where event.type == "start"]
  [ network where event.action == "setsockopt" and process.entity_id != null ] with runs=100

Splunk SPL Query

index=os sourcetype=auditd type=SYSCALL (syscall=setsockopt OR syscall=sendmsg)
| bin _time span=1m
| stats count as lease_ops values(syscall) as calls by host, exe, pid, uid, _time
| where lease_ops > 500
| sort -lease_ops
| table _time host exe pid uid lease_ops calls

Wazuh OSSEC Rule

<group name="linux,cve-2026-97597,">
  <rule id="100975" level="10" frequency="20" timeframe="120">
    <if_matched_sid>80700</if_matched_sid>
    <match>IPV6_FLOWLABEL_MGR|IPV6_FLOWINFO_SEND|flowlabel</match>
    <description>CVE-2026-97597: repeated IPv6 flow label lease operations from a single process (possible lease-list exhaustion)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix, no workaround, and no affected-version matrix is available.

1. Immediate mitigations:

   • Restrict untrusted local code execution on hosts that expose IPv6 flow-label handling to unprivileged processes, particularly in shared/container hosts.
   • Where operationally feasible, reduce reliance on per-socket flow-label leases and monitor unprivileged use of the flow-label socket interface.
   • Enforce the security model the upstream fix intends: do not rely on namespace-scoped capabilities for this control. On unpatched hosts, unprivileged users have no cap restriction at all on this path, so no namespace-level countermeasure restores the intended limit.
   • Use cgroups/memory accounting and per-container memory limits to bound the blast radius of kernel memory pressure attributable to a single workload.

2. Patch / upgrade steps:

   • Track the upstream Linux kernel fix implementing the FL_MAX_PER_SOCK cap in the flow-label recheck/reuse path, including the fl_intern() collision path.
   • Apply the kernel update once a commit/version is identified by the distribution vendor; no specific version or commit is provided by tracked sources (PATCH_DETAILS: none).
   • Validate the applied kernel enforces the cap with capable(CAP_NET_ADMIN) and only at-limit, so legitimate unprivileged GETs below the cap are unaffected.

3. Long-term hardening:

   • Maintain kernel patch hygiene and subscribe to CVE feeds for the Linux kernel; this fix touches flow-label memory accounting and is unlikely to appear in routine feature notes.
   • Monitor host kernel memory and per-socket resource usage for anomalous growth patterns tied to a single process.
   • Apply least-privilege and container isolation controls so that a single workload cannot degrade a shared kernel.

References

• NVD — CVE-2026-97597: https://nvd.nist.gov/vuln/detail/CVE-2026-97597
• FIRST.org EPSS — not yet scored (no value published): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — status: NOT listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Linux kernel upstream (IPv6 flow label subsystem source and commit history): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html

No threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-97597 in the data provided. No public PoC, exploit code, or Nuclei template exists per tracked sources.