CVE-2026-97602

A flaw was found in the Linux kernel. During network namespace cleanup, incomplete packet fragmentation queues are flushed without properly updating their completion state. A local attacker with access to unprivileged network namespaces can exploit this race condition during IPv6 packet reassembly, leading to out-of-bounds memory access and heap corruption. This issue may allow an attacker to achieve local privilege escalation or cause a denial of service (DoS) by crashing the system.

This vulnerability is rated as Important severity because an unprivileged local user can exploit heap corruption to gain elevated root privileges or crash the host. Exploitation requires the ability to create unprivileged network namespaces alongside IPv6 handling to trigger the race condition upon namespace teardown. Earlier enterprise releases, including RHEL 8 and RHEL 9, are unaffected as the vulnerable fragmentation queue handling code is not present in their kernel baselines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.