Executive brief
A vulnerability in the Linux kernel's networking component can cause a system to hang or fail when removing network interfaces. This occurs because the system fails to properly clean up certain internal routing references, leading to a resource leak. In practice, this could allow a local user to cause a denial-of-service condition by exhausting system resources or preventing network configuration changes.
Technical details
A reference count leak exists in net/ipv4/fib_trie.c within the Linux kernel. The root cause is that fib_table_flush() was designed to only flush error routes (e.g., blackhole routes) during network namespace dismantlement. Consequently, when a nexthop object associated with an error route is deleted, the route is not flushed, causing it to maintain a stale reference to the nexthop object and its associated network device. This prevents the netdevice from being fully unregistered, resulting in 'waiting for device to become free' errors. The fix modifies fib_table_flush() to ensure error routes are flushed if their nexthop is marked as dead (RTNH_F_DEAD).
Affected products
- Linux Linux Kernel 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-12-21: disclosed: Initial patch submitted by Ido Schimmel
- 2026-01-11: patched: Patches committed to various stable kernel branches
- 2026-01-13: advisory: CVE published
References
- https://git.kernel.org/stable/c/30386e090c49e803c0616a7147e43409c32a2b0e
- https://git.kernel.org/stable/c/33ff5c207c873215e54e6176624ed57423cb7dea
- https://git.kernel.org/stable/c/5979338c83012110ccd45cae6517591770bfe536
- https://git.kernel.org/stable/c/5de7ad7e18356e39e8fbf7edd185a5faaf4f385a
- https://git.kernel.org/stable/c/ac782f4e3bfcde145b8a7f8af31d9422d94d172a
- https://git.kernel.org/stable/c/e3fc381320d04e4a74311e576a86cac49a16fc43
- https://git.kernel.org/stable/c/ee4183501ea556dca31f5ffd8690aa9fd25b609f