PT-2026-2618 · Linux+2 · Linux Kernel+2
Published
2026-01-13
·
Updated
2026-05-11
·
CVE-2025-71097
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A reference count leak exists in the IPv4 implementation when using error routes with nexthop objects. Specifically, when a nexthop object is deleted, error routes do not get flushed, leading to a reference count leak on the nexthop object and its associated device. This occurs because the flushing of error routes in
fib table flush() is only performed during network namespace dismantling, not when the nexthop object is deleted directly. The issue does not affect IPv6. An example scenario involves adding a dummy network interface, a nexthop, and both regular and blackhole routes using the nexthop. Deleting the nexthop leaves the blackhole route holding a reference, preventing the device from being freed.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu