CVE-2025-71097ipv4: Fix reference count leak when using error routes with nexthop objects
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when using error routes with nexthop objects When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop. The current logic in fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their nexthop object is deleted: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 # ip route show blackhole 198.51.100.2 nhid 1 dev dummy1 As such, they keep holding a reference on the nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak: # ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2 Fix by flushing error routes when their nexthop is marked as dead. IPv6 does not suffer from this problem.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 493ced1ac47c48bb86d9d4e8e87df8592be85a0e builds before 5de7ad7e18356e39e8fbf7edd185a5faaf4f385a; 493ced1ac47c48bb86d9d4e8e87df8592be85a0e builds before 33ff5c207c873215e54e6176624ed57423cb7dea; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before 30386e090c49e803c0616a7147e43409c32a2b0e; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before 5979338c83012110ccd45cae6517591770bfe536; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before ee4183501ea556dca31f5ffd8690aa9fd25b609f; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before e3fc381320d04e4a74311e576a86cac49a16fc43; from 493ced1ac47c48bb86d9d4e8e87df8592be85a0e before ac782f4e3bfcde145b8a7f8af31d9422d94d172a | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.3.1 before 5.10.248; from 5.11 before 5.15.198; from 5.16 before 6.1.160; from 6.2 before 6.6.120; from 6.7 before 6.12.64; from 6.13 before 6.18.4; 5.3; 6.19; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/5de7ad7e18356e39e8fbf7edd185a5faaf4f385apatch
- https://git.kernel.org/stable/c/33ff5c207c873215e54e6176624ed57423cb7deapatch
- https://git.kernel.org/stable/c/30386e090c49e803c0616a7147e43409c32a2b0epatch
- https://git.kernel.org/stable/c/5979338c83012110ccd45cae6517591770bfe536patch
- https://git.kernel.org/stable/c/ee4183501ea556dca31f5ffd8690aa9fd25b609fpatch
- https://git.kernel.org/stable/c/e3fc381320d04e4a74311e576a86cac49a16fc43patch
- https://git.kernel.org/stable/c/ac782f4e3bfcde145b8a7f8af31d9422d94d172apatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.