---
id: CVE-2026-97939
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipmr: account multicast table and route memory

  A netadmin in a user+net namespace can create many IPv4 and IPv6
  multicast routing tables with MRT_TABLE and MRT6_TABLE.…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipmr: account multicast table and route memory

  A netadmin in a user+net namespace can create many IPv4 and IPv6
  multicast routing tables with MRT_TABLE and MRT6_TABLE.…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    0264b3ee09b118fec8a5471b4ca288f8ab84722f
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c
  - >-
    Linux >= f0ad0860d01e47a3ffd220564c5c653b3afbe962 <
    b7ee18725f2292ab554aa96a101ae42d45f008bd
  - Linux 2.6.35
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:21.303'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97939'
references:
  - url: 'https://git.kernel.org/stable/c/0264b3ee09b118fec8a5471b4ca288f8ab84722f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b7ee18725f2292ab554aa96a101ae42d45f008bd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.883Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipmr: account multicast table and route memory

A netadmin in a user+net namespace can create many IPv4 and IPv6
multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen
id allocates an mr_table via the shared mr_table_alloc(), links it
into the per-net list, and leaves it until netns teardown. Those
objects were not charged to memcg, so the host unreclaimable slab
grows with the table count.

Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the
IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established
handling of IP addresses, routes and alternate interface names.

Unresolved MFC entries are still allocated from softIRQ with
GFP_ATOMIC and are not charged. They expire after 10 seconds and are
bounded by the socket receive queue; see commit 0079ad8e8dc3
("ipmr: remove hard code cache_resolve_queue_len limit").

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.