CVE-2026-97939 Linux CVE debrief

Who should care

Linux kernel administrators and developers, network administrators using user+net namespaces, and security teams responsible for vulnerability management should verify and apply kernel updates, review system configurations, and monitor system resources to address potential slab growth issues.

Why it matters

A vulnerability in the Linux kernel's IPv4 and IPv6 multicast routing tables has been addressed, allowing for potential memory accounting and slab growth issues. Linux kernel administrators and developers, network administrators using user+net namespaces should verify and apply kernel updates, review system configurations, and monitor system resources.

• Verify kernel updates to ensure memory accounting for multicast routing tables
• Monitor system resources for potential slab growth
• Review system configurations for user+net namespace usage and multicast routing table creation

Technical summary

The Linux kernel's IPv4 and IPv6 multicast routing tables did not account for memory allocation, potentially leading to slab growth. The kernel now uses GFP_KERNEL_ACCOUNT for mr_table allocations and marks IPv4/IPv6 MFC caches as SLAB_ACCOUNT. This change ensures that memory allocations for multicast routing tables are properly accounted for, preventing potential slab growth issues. Linux kernel administrators and developers should verify and apply kernel updates to ensure memory accounting for multicast routing tables.

Defensive priority

Verify and apply kernel updates to ensure memory accounting for multicast routing tables.

Recommended defensive actions

• Verify kernel version and apply updates to ensure memory accounting for multicast routing tables
• Review system configurations for user+net namespace usage and multicast routing table creation
• Monitor system resources for potential slab growth
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution in the Linux kernel. The vulnerability was addressed by accounting for mr_table allocations with GFP_KERNEL_ACCOUNT and marking IPv4/IPv6 MFC caches as SLAB_ACCOUNT. Linux kernel administrators and developers, network administrators using user+net namespaces should verify kernel updates, review system configurations, and monitor system resources. Evidence is limited to public CVE details and NVD assessments; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.