CVE-2025-71097

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count leak exists in the IPv4 implementation when using error routes with nexthop objects. Specifically, when a nexthop object is deleted, error routes do not get flushed, leading to a reference count leak on the nexthop object and its associated device. This occurs because the flushing of error routes in fib table flush() is only performed during network namespace dismantling, not when the nexthop object is deleted directly. The issue does not affect IPv6. An example scenario involves adding a dummy network interface, a nexthop, and both regular and blackhole routes using the nexthop. Deleting the nexthop leaves the blackhole route holding a reference, preventing the device from being freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.