CVE-2026-52981 Overview
CVE-2026-52981 is a memory leak vulnerability in the Linux kernel's neighbour subsystem. The flaw resides in the neigh_xmit function, which is responsible for transmitting packets via the neighbour table. When neigh_xmit is invoked with an uninitialized neighbour table, such as NEIGH_ND_TABLE when IPv6 is disabled, the function returns -EAFNOSUPPORT and bypasses its internal out_kfree_skb error path. Callers including the MPLS subsystem rely on neigh_xmit to release the socket buffer (skb) or queue it for transmission. The result is a leaked skb on every failed transmission attempt through this path.
Critical Impact
Repeated invocation of neigh_xmit with an uninitialized neighbour table leaks kernel socket buffers, leading to memory exhaustion and potential denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing the neigh_xmit skb ownership flaw prior to the upstream fix
- Systems running MPLS or other subsystems that invoke neigh_xmit
- Kernels configured with IPv6 disabled where NEIGH_ND_TABLE remains uninitialized
Discovery Timeline
- 2026-06-24 - CVE-2026-52981 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52981
Vulnerability Analysis
The Linux kernel neigh_xmit function is documented to always release the skb, except when no neighbour table is found. In practice, callers such as the MPLS subsystem assume neigh_xmit always takes ownership of the skb and either transmits it or frees it on error. When the requested neighbour table is uninitialized, neigh_xmit returns -EAFNOSUPPORT without reaching out_kfree_skb. The caller ignores the return value and does not free the skb, leaking the buffer.
The upstream fix makes neigh_xmit assume full ownership of the skb in all code paths. The remaining branch that returned without freeing or transmitting is removed, aligning behaviour with caller expectations.
Root Cause
The root cause is an inconsistency in skb ownership semantics between neigh_xmit and its callers. The function declared exclusive ownership in most paths but left one error path where the caller would have to free the skb. Because no caller implements that recovery, the buffer leaks whenever the targeted neighbour table is uninitialized.
Attack Vector
An attacker with the ability to trigger MPLS or related transmissions against an uninitialized neighbour table can force repeated skb allocations that never get released. On kernels with IPv6 disabled, traffic routed through code paths that target NEIGH_ND_TABLE triggers the leak. Sustained exploitation gradually consumes kernel memory, degrading performance and potentially causing a denial-of-service condition.
No verified proof-of-concept code is publicly available. Refer to the upstream commits referenced in the Linux stable tree for the precise fix.
Detection Methods for CVE-2026-52981
Indicators of Compromise
- Gradual, unexplained growth in kernel slab memory associated with skbuff_head_cache over time
- Repeated -EAFNOSUPPORT returns from neighbour subsystem code paths when IPv6 is disabled
- MPLS or neighbour-related transmission errors logged without corresponding skb frees
Detection Strategies
- Audit running kernel versions against the patched commits listed in the kernel.org stable tree references
- Monitor /proc/slabinfo for sustained growth in skbuff_head_cache allocations on systems running MPLS workloads
- Correlate kernel memory pressure events with neighbour subsystem activity through telemetry pipelines
Monitoring Recommendations
- Enable kernel tracepoints on the neighbour subsystem to capture neigh_xmit invocations and error returns
- Track per-host kernel memory utilization trends and alert on anomalous slab growth
- Forward kernel logs and slab metrics to a centralized analytics platform for longitudinal review
How to Mitigate CVE-2026-52981
Immediate Actions Required
- Apply the upstream Linux kernel patches that make neigh_xmit take full skb ownership, available in the referenced stable tree commits
- Inventory all Linux hosts using MPLS or running with IPv6 disabled and prioritize them for kernel updates
- Reboot updated systems to load the patched kernel image
Patch Information
The vulnerability is resolved across multiple stable branches. Patched commits include 0084712e0bee, 4438113be604, 445e45a2c3a0, 63063ba60d2d, 8a89054a1ec0, and 9247d59ca15b. Distribution vendors are expected to backport the fix into their supported kernel streams. Review the Linux kernel stable tree for branch-specific availability.
Workarounds
- Where feasible, re-enable IPv6 so that NEIGH_ND_TABLE is initialized, eliminating the uninitialized-table error path
- Restrict or disable MPLS forwarding on hosts that cannot be patched immediately to limit exposure of the affected code path
- Schedule periodic reboots on unpatched hosts to reclaim leaked kernel memory until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
