CVE-2026-97939
Description
A flaw was found in the Linux kernel's IP multicast routing subsystem. A local user with network administration privileges inside a network namespace can create an excessive number of multicast routing tables. Because these allocations are not tracked against memory control group limits, kernel memory can grow without restriction. This issue allows an attacker to exhaust host system memory, leading to a Denial of Service (DoS).
Statement
A flaw of moderate severity was found in the Linux kernel's IP multicast routing subsystem (ipmr/ip6mr), which affects the kernel packages shipped in Red Hat Enterprise Linux (including kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform through its RHEL CoreOS kernel. A local user who is able to create a user and network namespace, and thereby obtains network administration (CAP_NET_ADMIN) privileges inside that namespace, can create a large number of IPv4 and IPv6 multicast routing tables using the MRT_TABLE and MRT6_TABLE socket options. Each previously unseen table identifier allocates kernel memory that is not charged to the memory control group (memcg) of the namespace or container, and the allocated objects remain linked into the per-network-namespace list until that namespace is destroyed. As a result, unreclaimable kernel slab memory on the host grows without restriction and can be exhausted, causing a denial of service. The flaw has no impact on confidentiality or integrity, and Red Hat has rated it Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fixes for the affected Red Hat products are currently deferred to a future scheduled update rather than an immediate z-stream fix; in the interim, the residual risk is that any local user who can already create user and network namespaces may exhaust host memory, with impact limited to resource exhaustion (denial of service) rather than privilege escalation or data compromise.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
