CVE-2026-97939

A flaw was found in the Linux kernel's IP multicast routing subsystem. A local user with network administration privileges inside a network namespace can create an excessive number of multicast routing tables. Because these allocations are not tracked against memory control group limits, kernel memory can grow without restriction. This issue allows an attacker to exhaust host system memory, leading to a Denial of Service (DoS).

A flaw of moderate severity was found in the Linux kernel's IP multicast routing subsystem (ipmr/ip6mr), which affects the kernel packages shipped in Red Hat Enterprise Linux (including kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform through its RHEL CoreOS kernel. A local user who is able to create a user and network namespace, and thereby obtains network administration (CAP_NET_ADMIN) privileges inside that namespace, can create a large number of IPv4 and IPv6 multicast routing tables using the MRT_TABLE and MRT6_TABLE socket options. Each previously unseen table identifier allocates kernel memory that is not charged to the memory control group (memcg) of the namespace or container, and the allocated objects remain linked into the per-network-namespace list until that namespace is destroyed. As a result, unreclaimable kernel slab memory on the host grows without restriction and can be exhausted, causing a denial of service. The flaw has no impact on confidentiality or integrity, and Red Hat has rated it Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fixes for the affected Red Hat products are currently deferred to a future scheduled update rather than an immediate z-stream fix; in the interim, the residual risk is that any local user who can already create user and network namespaces may exhaust host memory, with impact limited to resource exhaustion (denial of service) rather than privilege escalation or data compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.