CVE-2026-97597 Linux CVE debrief

Who should care

Linux kernel maintainers, system administrators, and security teams responsible for managing Linux kernel systems handling IPv6 flowlabels should assess exposure and apply patches or updates provided by the Linux kernel maintainers. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Additionally, they be

Why it matters

This vulnerability in the Linux kernel's IPv6 flowlabel handling can lead to resource exhaustion and potential DoS attacks. Linux kernel maintainers, system administrators, and security teams should assess exposure and apply patches or updates provided by the Linux kernel maintainers.

• Unbounded growth of socket lease lists can lead to resource exhaustion
• Potential for denial-of-service (DoS) attacks
• Requires verification of affected versions and exposure

Technical summary

The Linux kernel's IPv6 flowlabel handling has a vulnerability where repeated GET requests for one shareable label can grow a socket's lease list without bound. This issue is addressed by rejecting new unprivileged leases once the socket already holds FL_MAX_PER_SOCK leases. The vulnerability can lead to resource exhaustion and potential DoS attacks. Linux kernel maintainers, system administrators, and security teams should assess exposure and apply patches or updates provided by the Linux kernel maintainers. The ipv6_flowlabel_get() function allocates an ipv6_fl_socklist entry for every successful GET request, which can lead to unbounded growth of a socket's lease list.

Defensive priority

Assess exposure and apply patches for Linux kernel systems handling IPv6 flowlabels.

Recommended defensive actions

• Assess exposure of Linux kernel systems handling IPv6 flowlabels
• Apply patches or updates provided by the Linux kernel maintainers
• Monitor systems for unusual IPv6 flowlabel activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Linux kernel's IPv6 flowlabel handling, which can lead to resource exhaustion and potential DoS attacks. However, its scope and impact require further verification, especially regarding affected versions and exposure. Linux kernel maintainers, system administrators, and security teams should assess the vulnerability and apply patches or updates provided by the Linux kernel maintainers. The vulnerability is caused by the ipv6_flowlabel_get() function allocating an

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.