---
id: CVE-2026-97939
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipmr: account multicast table and route memory

  A netadmin in a user+net namespace can create many IPv4 and IPv6
  multicast routing tables with MRT_TABLE and MRT6_TABLE.…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipmr: account multicast table and route memory

  A netadmin in a user+net namespace can create many IPv4 and IPv6
  multicast routing tables with MRT_TABLE and MRT6_TABLE.…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    ec1c6140394ee87127479bc500a3158b125bf07a
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    0264b3ee09b118fec8a5471b4ca288f8ab84722f
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    b7ee18725f2292ab554aa96a101ae42d45f008bd
  - Linux 2.6.35
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:19.503'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97939'
references:
  - url: 'https://git.kernel.org/stable/c/0264b3ee09b118fec8a5471b4ca288f8ab84722f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b7ee18725f2292ab554aa96a101ae42d45f008bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ec1c6140394ee87127479bc500a3158b125bf07a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97939.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97939'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541143'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97939'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97939'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97939.mbox
  - url: 'https://git.kernel.org/stable/c/21e0749e8ef272ac7e3eefe0fa488a5983f4b038'
  - url: 'https://git.kernel.org/stable/c/3e808d8dfebd8f114a747bd90c8f7d2a6fd7474f'
  - url: 'https://git.kernel.org/stable/c/57c523e95ea2608a19e6bfcd664d641ddf7bc4b4'
  - url: 'https://git.kernel.org/stable/c/20424f267c9dbdfcade28b2b2306767a7dfb43d1'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00217
epssPercentile: 0.12281
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.883Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipmr: account multicast table and route memory

A netadmin in a user+net namespace can create many IPv4 and IPv6
multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen
id allocates an mr_table via the shared mr_table_alloc(), links it
into the per-net list, and leaves it until netns teardown. Those
objects were not charged to memcg, so the host unreclaimable slab
grows with the table count.

Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the
IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established
handling of IP addresses, routes and alternate interface names.

Unresolved MFC entries are still allocated from softIRQ with
GFP_ATOMIC and are not charged. They expire after 10 seconds and are
bounded by the socket receive queue; see commit 0079ad8e8dc3
("ipmr: remove hard code cache_resolve_queue_len limit").

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97939.json)