{"id":"CVE-2025-71097","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.3.1, < 5.10.248","linux_kernel >= 5.11, < 5.15.198","linux_kernel >= 5.16, < 6.1.160","linux_kernel >= 6.2, < 6.6.120","linux_kernel >= 6.7, < 6.12.64","linux_kernel >= 6.13, < 6.18.4","linux_kernel = 5.3","linux_kernel = 6.19"],"patched":["linux_kernel 6.18.4"],"published":"2026-01-13","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:18:19.747","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71097","references":[{"url":"https://git.kernel.org/stable/c/30386e090c49e803c0616a7147e43409c32a2b0e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33ff5c207c873215e54e6176624ed57423cb7dea","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5979338c83012110ccd45cae6517591770bfe536","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5de7ad7e18356e39e8fbf7edd185a5faaf4f385a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac782f4e3bfcde145b8a7f8af31d9422d94d172a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3fc381320d04e4a74311e576a86cac49a16fc43","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee4183501ea556dca31f5ffd8690aa9fd25b609f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.0014,"epssPercentile":0.03358,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:40:27.713433Z"},"ingestedAt":"2026-09-08T15:33:26.995Z","slug":"CVE-2025-71097","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called to flush all the routes that are using the\ndead nexthop.\n\nThe current logic in fib_table_flush() is to only flush error routes\n(e.g., blackhole) when it is called as part of network namespace\ndismantle (i.e., with flush_all=true). Therefore, error routes are not\nflushed when their nexthop object is deleted:\n\n # ip link add name dummy1 up type dummy\n # ip nexthop add id 1 dev dummy1\n # ip route add 198.51.100.1/32 nhid 1\n # ip route add blackhole 198.51.100.2/32 nhid 1\n # ip nexthop del id 1\n # ip route show\n blackhole 198.51.100.2 nhid 1 dev dummy1\n\nAs such, they keep holding a reference on the nexthop object which in\nturn holds a reference on the nexthop device, resulting in a reference\ncount leak:\n\n # ip link del dev dummy1\n [   70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2\n\nFix by flushing error routes when their nexthop is marked as dead.\n\nIPv6 does not suffer from this problem.\n\n## Affected\n\n- `linux_kernel >= 5.3.1, < 5.10.248`\n- `linux_kernel >= 5.11, < 5.15.198`\n- `linux_kernel >= 5.16, < 6.1.160`\n- `linux_kernel >= 6.2, < 6.6.120`\n- `linux_kernel >= 6.7, < 6.12.64`\n- `linux_kernel >= 6.13, < 6.18.4`\n- `linux_kernel = 5.3`\n- `linux_kernel = 6.19`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.18.4`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":221577,"id":"CVE-2025-71097","ts":1792035280011,"field":"cvss","old":null,"new":"5.5"},{"seq":221576,"id":"CVE-2025-71097","ts":1792035280011,"field":"severity","old":"none","new":"medium"}]}