- 5.5MediumCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when using error routes with nexthop objects When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop. The current logic in fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their nexthop object is deleted: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 # ip route show blackhole 198.51.100.2 nhid 1 dev dummy1 As such, they keep holding a reference on the nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak: # ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2 Fix by flushing error routes when their nexthop is marked as dead. IPv6 does not suffer from this problem.
Timeline
ID reserved
By Linux
Published
- 9 months later
· 9 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (9 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < 5de7ad7e18356e39e8fbf7edd185a5faaf4f385a
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < 33ff5c207c873215e54e6176624ed57423cb7dea
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < 30386e090c49e803c0616a7147e43409c32a2b0e
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < 5979338c83012110ccd45cae6517591770bfe536
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < ee4183501ea556dca31f5ffd8690aa9fd25b609f
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < e3fc381320d04e4a74311e576a86cac49a16fc43
- affected 493ced1ac47c48bb86d9d4e8e87df8592be85a0e – < ac782f4e3bfcde145b8a7f8af31d9422d94d172a
- affected 5.3
- unaffected < 5.3
- unaffected 5.10.248 – ≤ 5.10.*
- unaffected 5.15.198 – ≤ 5.15.*
- unaffected 6.1.160 – ≤ 6.1.*
- unaffected 6.6.120 – ≤ 6.6.*
- unaffected 6.12.64 – ≤ 6.12.*
- unaffected 6.18.4 – ≤ 6.18.*
- unaffected 6.19 – ≤ *
References
9
- https://git.kernel.org/stable/c/5de7ad7e18356e39e8fbf7edd185a5faaf4f385a (opens in a new tab)
- https://git.kernel.org/stable/c/33ff5c207c873215e54e6176624ed57423cb7dea (opens in a new tab)
- https://git.kernel.org/stable/c/30386e090c49e803c0616a7147e43409c32a2b0e (opens in a new tab)
- https://git.kernel.org/stable/c/5979338c83012110ccd45cae6517591770bfe536 (opens in a new tab)
- https://git.kernel.org/stable/c/ee4183501ea556dca31f5ffd8690aa9fd25b609f (opens in a new tab)
- https://git.kernel.org/stable/c/e3fc381320d04e4a74311e576a86cac49a16fc43 (opens in a new tab)
- https://git.kernel.org/stable/c/ac782f4e3bfcde145b8a7f8af31d9422d94d172a (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-2225 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-71097)Record last updated .