CVE-2026-97602

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where fqdir pre exit() flushes socket buffers (skbs) from incomplete queues without updating their completion state. This allows a fragment to acquire a queue lock and reuse stale reassembly metadata. In IPv6, this can cause the ip6 frag reasm() function to use an outdated nhoffset with a new skb, leading to out-of-bounds memory access. This heap corruption can be exploited for local privilege escalation when unprivileged network namespaces are available. Additionally, unflushed fragments may keep conntrack references active beyond the per-net cleanup point.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.