CVE-2026-97939

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipmr: account multicast table and route memory

A netadmin in a user+net namespace can create many IPv4 and IPv6

multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen

id allocates an mr_table via the shared mr_table_alloc(), links it

into the per-net list, and leaves it until netns teardown. Those

objects were not charged to memcg, so the host unreclaimable slab

grows with the table count.

Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the

IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established

handling of IP addresses, routes and alternate interface names.

Unresolved MFC entries are still allocated from softIRQ with

GFP_ATOMIC and are not charged. They expire after 10 seconds and are

bounded by the socket receive queue; see commit 0079ad8e8dc3

("ipmr: remove hard code cache_resolve_queue_len limit").

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References