ipv4: Fix reference count leak when using error routes with nexthop objects
Published Jan 13, 2026
5.5
MEDIUMCVSS 3.1
EPSS 0.13%
Description
When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop.
The current logic in fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their nexthop object is deleted:
# ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 # ip route show blackhole 198.51.100.2 nhid 1 dev dummy1
As such, they keep holding a reference on the nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak:
# ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2
Fix by flushing error routes when their nexthop is marked as dead.
IPv6 does not suffer from this problem.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.3StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.3
- Version 5.10.248StatusunaffectedConstraints<=5.10.*
- Version 5.15.198StatusunaffectedConstraints<=5.15.*
- Version 6.1.160StatusunaffectedConstraints<=6.1.*
- Version 6.12.64StatusunaffectedConstraints<=6.12.*
- Version 6.18.4StatusunaffectedConstraints<=6.18.*
- Version 6.19StatusunaffectedConstraints<=*
- Version 6.6.120StatusunaffectedConstraints<=6.6.*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| ||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
- ≥ 5.3.1 · < 5.10.248
- ≥ 5.11 · < 5.15.198
- ≥ 5.16 · < 6.1.160
- ≥ 6.2 · < 6.6.120
- ≥ 6.7 · < 6.12.64
- ≥ 6.13 · < 6.18.4
- 5.3
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
No data.
Red Hat Enterprise Linux 10
kernel
Affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Affected
Red Hat Enterprise Linux 9
kernel-rt
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Jun 10, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Jan–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.13% (0.00134) | 2.40th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.11% (0.00114) | 1.78th | v5 (v2026.06.15) |
| Jan 14, 2026 | 0.02% (0.00018) | 3.87th | v4 (v2025.03.14) |
References (13)
- https://access.redhat.com/security/cve/CVE-2025-71097 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2429035 Issue Tracking
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://git.kernel.org/stable/c/30386e090c49e803c0616a7147e43409c32a2b0e Patch
- https://git.kernel.org/stable/c/33ff5c207c873215e54e6176624ed57423cb7dea Patch
- https://git.kernel.org/stable/c/5979338c83012110ccd45cae6517591770bfe536 Patch
- https://git.kernel.org/stable/c/5de7ad7e18356e39e8fbf7edd185a5faaf4f385a Patch
- https://git.kernel.org/stable/c/ac782f4e3bfcde145b8a7f8af31d9422d94d172a Patch
- https://git.kernel.org/stable/c/e3fc381320d04e4a74311e576a86cac49a16fc43 Patch
- https://git.kernel.org/stable/c/ee4183501ea556dca31f5ffd8690aa9fd25b609f Patch
- https://lore.kernel.org/linux-cve-announce/2026011344-CVE-2025-71097-7cfc@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2025-71097
- https://www.cve.org/CVERecord?id=CVE-2025-71097
Change history (0)
No recorded changes yet.