Shared Linux hosts need a different response to CVE-2026-97597 than single-purpose appliances. The vulnerability is local and causes kernel memory exhaustion, so the highest-risk systems are those that let low-trust users or workloads run code on a kernel shared by many services.
Vulnerability overview
CVE-2026-97597 affects Linux IPv6 flowlabel lease reuse. A socket can repeatedly acquire duplicate leases for one shareable label without the normal per-socket admission check. The list and reference count grow while the global count of distinct flowlabels does not.
The Linux kernel CVE record lists affected kernels from 2.6.12 and fixed releases 6.12.112, 6.18.53, 7.2.7, and 7.3-rc3. Ubuntu rates the issue Medium with a CVSS v4.0 base score of 6.8 and high availability impact.
Mechanism and exploitation conditions
The process opens an IPv6 socket and sends flowlabel manager GET operations. After the first shareable label is created, repeated GET requests reuse that label and link duplicate leases. In a vulnerable kernel, the list can grow until allocator pressure disrupts the host.
The public patch says the issue is reachable by a non-root user without namespace setup. The fix rejects a new unprivileged lease when the socket already holds 32 entries and uses capable(CAP_NET_ADMIN) so a user namespace cannot substitute for host-level administrative control. The check runs before linger and expiration updates, so a rejected GET does not refresh the label.
The public reproducer triggered OOM on a 2 vCPU, 2 GB virtual machine. Production timing will differ, but the test confirms the denial-of-service mechanism without relying on a remote service.
Impact
The attacker can create availability loss through kernel memory pressure. The OOM killer may terminate unrelated workloads or a system may become unresponsive. Multi-tenant hosts have the largest immediate concern because one tenant's local process can affect the host and other tenants.
The reviewed sources do not show a direct confidentiality, integrity, or privilege-escalation impact. A host compromised by another flaw could use this issue to deepen availability disruption, but that is a chained scenario rather than a property of CVE-2026-97597 alone.
Affected products and scope
Upstream fixed versions are recorded as 6.12.112, 6.18.53, 7.2.7, and 7.3-rc3. Debian's tracker listed trixie 6.12.113-1, forky 7.2.12-1, and sid 7.2.15-1 as fixed. The bookworm security kernel at 6.1.190-1 was vulnerable, while the separate linux-6.12 backport at 6.12.113-1~deb12u1 was fixed.
Ubuntu's page showed a mixture of vulnerable and work-in-progress kernels across releases and flavors. Operators should verify the exact running kernel and package build. Cloud images and machine templates must be updated too, or replacement hosts will recreate the exposure.
Exposure context
ZoomEye Search os="Linux" returned 74,530,496 matches. The CVE Filter vul.cve="CVE-2026-97597" returned 0. The selected Exposure is 74,530,496.
This is a broad Linux fingerprint count, not a confirmed vulnerable-asset count. It does not identify tenants, local shell access, kernel versions, or IPv6 configuration. Use it to estimate the size of a Linux inventory that needs internal validation.
Remediation and mitigations
Start with a kernel inventory that records release, package build, boot status, and distribution. Install the fixed package and reboot into the selected kernel. Verify after reboot and update golden images.
Prioritize customer-facing multi-tenant hosts, build systems, shared shells, and container hosts that accept untrusted images. Until reboot completes, treat the host as unpatched. Monitor for abnormal OOM activity and repeated flowlabel manager operations from low-privileged processes. Restrict untrusted local execution where policy allows. Do not use the public reproducer in production.
Track remediation to completion across the host fleet, including cloud, edge, real-time, and specialized kernels. A fixed package on disk is not a closed finding if the vulnerable kernel is still running.