CVE-2026-97598

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97598", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.157Z", "datePublished": "2026-09-25T10:22:12.972Z", "dateUpdated": "2026-10-19T09:10:02.029Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:02.029Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: bound automatic table ID allocation\n\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one. IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\n\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path. Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\n\nThis changes user-visible behavior. A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied. Explicit table IDs above\n4096 remain usable.\n\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_rules.c"], "versions": [{"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "999bc00588cb305ab25065e8a8ac31da7465301c", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "125890702ef4417cd0ffac2e448c0cd4fbf0ac45", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "3080f9e653d8c057d5652db5ced8137f81b3fcbd", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "bc8d01d856db106f284b19961af6112e10c3e3b4", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "fe9a906d2bff2d2707bafd6353b5e032a42aeb35", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503", "status": "affected", "versionType": "git"}, {"version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "lessThan": "efdfb1e27a3328085b79540dfe781d537b576ea1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/fib_rules.c"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/999bc00588cb305ab25065e8a8ac31da7465301c"}, {"url": "https://git.kernel.org/stable/c/f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6"}, {"url": "https://git.kernel.org/stable/c/125890702ef4417cd0ffac2e448c0cd4fbf0ac45"}, {"url": "https://git.kernel.org/stable/c/3080f9e653d8c057d5652db5ced8137f81b3fcbd"}, {"url": "https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4"}, {"url": "https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35"}, {"url": "https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503"}, {"url": "https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1"}], "title": "ipv4: fib: bound automatic table ID allocation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/fib_rules.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "999bc00588cb305ab25065e8a8ac31da7465301c", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "125890702ef4417cd0ffac2e448c0cd4fbf0ac45", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "3080f9e653d8c057d5652db5ced8137f81b3fcbd", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "bc8d01d856db106f284b19961af6112e10c3e3b4", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "fe9a906d2bff2d2707bafd6353b5e032a42aeb35", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}, {"lessThan": "efdfb1e27a3328085b79540dfe781d537b576ea1", "status": "affected", "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/fib_rules.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: bound automatic table ID allocation\n\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one. IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\n\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path. Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\n\nThis changes user-visible behavior. A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied. Explicit table IDs above\n4096 remain usable.\n\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0."}], "id": "CVE-2026-97598", "lastModified": "2026-10-19T10:17:29.457", "metrics": {}, "published": "2026-09-25T11:17:11.130", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/125890702ef4417cd0ffac2e448c0cd4fbf0ac45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3080f9e653d8c057d5652db5ced8137f81b3fcbd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/999bc00588cb305ab25065e8a8ac31da7465301c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipv4: fib: bound automatic table ID allocation", "id": "2541301", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541301"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv4: fib: bound automatic table ID allocation\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one. IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path. Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\nThis changes user-visible behavior. A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied. Explicit table IDs above\n4096 remain usable.\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0.", "A flaw was found in the Linux kernel's IPv4 routing subsystem. This vulnerability allows a local user with network configuration privileges to cause a Denial of Service (DoS). When automatic routing table identifier allocation is requested, the kernel searches through table identifiers without an upper bound while holding the internal Routing Netlink (RTNL) lock. By repeatedly triggering this automatic allocation, an attacker can cause severe lock contention and kernel processing delays that make network management unresponsive."], "name": "CVE-2026-97598", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97598\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97598\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97598.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b801f54917b7c6e8540f877ee562cd0725e62ebd,bc8d01d856db106f284b19961af6112e10c3e3b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b801f54917b7c6e8540f877ee562cd0725e62ebd,fe9a906d2bff2d2707bafd6353b5e032a42aeb35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b801f54917b7c6e8540f877ee562cd0725e62ebd,2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b801f54917b7c6e8540f877ee562cd0725e62ebd,efdfb1e27a3328085b79540dfe781d537b576ea1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T13:45:18.891496+00:00", "updated": "2026-10-01T08:30:05.233575+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-400", "CWE-770"]}