CVE-2025-71097: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71097 is a reference count leak vulnerability in the Linux kernel's IPv4 routing subsystem, specifically in the fib_table_flush() function when handling error routes (e.g., blackhole routes) associated with nexthop objects. When a nexthop object is deleted, error routes referencing it are not properly flushed, causing those routes to retain references to the nexthop object and its underlying network device, preventing proper device cleanup. The vulnerability affects Linux kernel versions from 5.3 through multiple stable branches up to 6.18.x, and was published on January 13, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is a logic flaw in fib_table_flush() in the Linux kernel's IPv4 FIB (Forwarding Information Base) implementation, classified as CWE-Other (improper resource management). The function only flushes error routes (such as blackhole routes) during full network namespace dismantle (flush_all=true), but not when an individual nexthop object is marked as dead and deleted. As a result, error routes continue to hold a reference on the dead nexthop object, which in turn holds a reference on the associated network device, creating a reference count leak. A low-privileged local user with access to network configuration commands (ip nexthop, ip route) can trigger this condition by creating a blackhole route tied to a nexthop object and then deleting the nexthop — the device subsequently cannot be unregistered, as evidenced by kernel messages such as unregister_netdevice: waiting for dummy1 to become free. Usage count = 2. IPv6 is not affected by this issue (Feedly).

Successful exploitation results in a denial of service condition through resource exhaustion: network devices cannot be properly unregistered due to the leaked reference counts, leading to system resource depletion and potential kernel instability. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS availability impact: High). In environments where network namespaces and nexthop objects are frequently created and destroyed (e.g., container orchestration platforms), repeated triggering could accumulate leaked references and degrade system stability over time (Feedly).

1. Gain local access: Obtain a low-privileged shell on a vulnerable Linux system (kernel versions 5.3–6.18.3 or equivalent stable branches before the fix).
2. Create a dummy network device: Run ip link add name dummy1 up type dummy to create a test network interface.
3. Add a nexthop object: Run ip nexthop add id 1 dev dummy1 to associate a nexthop with the device.
4. Create an error route referencing the nexthop: Run ip route add blackhole 198.51.100.2/32 nhid 1 to add a blackhole route tied to the nexthop object.
5. Delete the nexthop object: Run ip nexthop del id 1 — the kernel marks the nexthop as dead but fails to flush the blackhole route, leaving a dangling reference.
6. Attempt to remove the device: Run ip link del dev dummy1 — the device cannot be unregistered, and the kernel logs unregister_netdevice: waiting for dummy1 to become free. Usage count = 2.
7. Repeat to exhaust resources: Repeat steps 2–6 in a loop to accumulate reference count leaks, progressively degrading system availability (Feedly).

• Logs: Kernel messages containing unregister_netdevice: waiting for <device> to become free. Usage count = <N> in /var/log/kern.log or dmesg output, especially with usage counts greater than 1 after device deletion attempts.
• Network: Persistent blackhole or other error routes visible via ip route show that reference nexthop IDs which no longer exist (orphaned routes after nexthop deletion).
• Process/Command Activity: Repeated invocations of ip nexthop add/del and ip route add blackhole commands by non-root, low-privileged users, particularly in rapid succession.
• System Resources: Gradual increase in kernel memory usage or network device reference counts observable via /proc/net/ or kernel debugging interfaces, without corresponding legitimate network configuration changes.

Apply kernel updates to the following fixed versions: 5.10.248 or later, 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, or 6.18.4 or later. For Microsoft Azure Linux 3 (azl3), update to kernel version 6.6.119.3-3 or later. Patches are available via the upstream kernel stable tree at git.kernel.org. As a temporary workaround until patching is complete, restrict local user access to network configuration capabilities (e.g., limit use of CAP_NET_ADMIN) and monitor system logs for unregister_netdevice warning messages. Debian, Ubuntu, Amazon Linux 2, and Oracle Linux have all issued distribution-specific advisories with updated kernel packages (Feedly, Ubuntu USN-8177-1).