{"id":"CVE-2025-71097","revision":"11e45ed3c392454f93d100a6bf190089","records":[{"revision":"11e45ed3c392454f93d100a6bf190089","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71097","aliases":[],"title":"ipv4: Fix reference count leak when using error routes with nexthop objects","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called to flush all the routes that are using the\ndead nexthop.\n\nThe current logic in fib_table_flush() is to only flush error routes\n(e.g., blackhole) when it is called as part of network namespace\ndismantle (i.e., with flush_all=true). Therefore, error routes are not\nflushed when their nexthop object is deleted:\n\n # ip link add name dummy1 up type dummy\n # ip nexthop add id 1 dev dummy1\n # ip route add 198.51.100.1/32 nhid 1\n # ip route add blackhole 198.51.100.2/32 nhid 1\n # ip nexthop del id 1\n # ip route show\n blackhole 198.51.100.2 nhid 1 dev dummy1\n\nAs such, they keep holding a reference on the nexthop object which in\nturn holds a reference on the nexthop device, resulting in a reference\ncount leak:\n\n # ip link del dev dummy1\n [   70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2\n\nFix by flushing error routes when their nexthop is marked as dead.\n\nIPv6 does not suffer from this problem.","state":0,"publishedAt":"2026-01-13T15:34:56.814+00:00","modifiedAt":"2026-10-19T18:15:12.771+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/fib_trie.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"5de7ad7e18356e39e8fbf7edd185a5faaf4f385a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"33ff5c207c873215e54e6176624ed57423cb7dea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"30386e090c49e803c0616a7147e43409c32a2b0e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"5979338c83012110ccd45cae6517591770bfe536\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"ee4183501ea556dca31f5ffd8690aa9fd25b609f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"e3fc381320d04e4a74311e576a86cac49a16fc43\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"493ced1ac47c48bb86d9d4e8e87df8592be85a0e\",\n                            \"lessThan\": \"ac782f4e3bfcde145b8a7f8af31d9422d94d172a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/fib_trie.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.248\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.198\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.160\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.120\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.64\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.4\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/5de7ad7e18356e39e8fbf7edd185a5faaf4f385a","https://git.kernel.org/stable/c/33ff5c207c873215e54e6176624ed57423cb7dea","https://git.kernel.org/stable/c/30386e090c49e803c0616a7147e43409c32a2b0e","https://git.kernel.org/stable/c/5979338c83012110ccd45cae6517591770bfe536","https://git.kernel.org/stable/c/ee4183501ea556dca31f5ffd8690aa9fd25b609f","https://git.kernel.org/stable/c/e3fc381320d04e4a74311e576a86cac49a16fc43","https://git.kernel.org/stable/c/ac782f4e3bfcde145b8a7f8af31d9422d94d172a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71097","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71097","identifiers":["CVE-2025-71097"]},"retained":false,"historicalAffected":[]}],"coverage":[]}