CVE-2026-98104

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98104", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.315Z", "datePublished": "2026-09-25T10:35:54.544Z", "dateUpdated": "2026-10-19T09:13:56.808Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:13:56.808Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: fix duplicate handle when node ID pool is exhausted\n\ngen_new_kid() falls back to returning max (htid | 0xFFF) when both\nidr_alloc_u32() ranges are full, instead of reporting an error.\nu32_change() trusts that value and inserts a new knode with a handle\nthat is already live in the hash table, breaking handle uniqueness\nwithin the table's node ID space.\n\nThe handle was never reserved in ht->handle_idr, so every later error\npath that does idr_remove(&ht->handle_idr, handle) removes the\nreservation of a different, live knode, which is then reused \u2014 one\nfailed add compounds into further duplicates.\n\nThe 4095 limit is per (table, bucket) \u2014 ht->handle_idr is per hash\ntable and the range is derived from htid (bucketid), so a table with\ndivisor 256 can legitimately hold 256*4095 knodes.\n\nThe sibling helper gen_new_htid() has the same silent in-band failure:\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and\nu32_init() publishes the root hash table with handle 0 without\nchecking. Two root tables with handle 0 alias in u32_lookup_ht(),\nallowing cross-tcf_proto knode add/lookup/delete. Add the same\nexhaustion check that the divisor path already has.\n\nReturn an error so u32_change() fails with ENOSPC/ENOMEM when the\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM\nwhen the hash table ID space is exhausted. The extack message\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation\nfailure (-ENOMEM).\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded)\n- Create a clsact qdisc on a device, then add 4095 u32 filters with\n auto-generated handles to fill the node ID space for the root hash\n table (single bucket). The 4096th auto-handle filter add triggers\n the duplicate handle (fh 800::fff reused). Reachable at Level 2\n (unshare -Urn, namespace-local CAP_NET_ADMIN).\n- For gen_new_htid: create 2047 u32 proto entries on the same block\n to fill the tp_c handle pool, then create one more. The root table\n gets handle 0 and aliases with other handle-0 root tables."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/cls_u32.c"], "versions": [{"version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "lessThan": "f4ee13ed7f7b22dcd8287fcf477ae37bd84567da", "status": "affected", "versionType": "git"}, {"version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "lessThan": "84223baf21bc9b008444ae9bc38d5fb91fe00b9d", "status": "affected", "versionType": "git"}, {"version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "lessThan": "6890e28840bae4f6805e8de981c4ec8e12a4e064", "status": "affected", "versionType": "git"}, {"version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "lessThan": "feab9261b537df4ebb8350e4779bc185373059fd", "status": "affected", "versionType": "git"}, {"version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "lessThan": "f594f04268d01c5fdc975f3f51fc219ea2159ac6", "status": "affected", "versionType": "git"}, {"version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "lessThan": "d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/cls_u32.c"], "versions": [{"version": "3.16", "status": "affected"}, {"version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f4ee13ed7f7b22dcd8287fcf477ae37bd84567da"}, {"url": "https://git.kernel.org/stable/c/84223baf21bc9b008444ae9bc38d5fb91fe00b9d"}, {"url": "https://git.kernel.org/stable/c/6890e28840bae4f6805e8de981c4ec8e12a4e064"}, {"url": "https://git.kernel.org/stable/c/feab9261b537df4ebb8350e4779bc185373059fd"}, {"url": "https://git.kernel.org/stable/c/f594f04268d01c5fdc975f3f51fc219ea2159ac6"}, {"url": "https://git.kernel.org/stable/c/d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f"}], "title": "net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/cls_u32.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f4ee13ed7f7b22dcd8287fcf477ae37bd84567da", "status": "affected", "version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "versionType": "git"}, {"lessThan": "84223baf21bc9b008444ae9bc38d5fb91fe00b9d", "status": "affected", "version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "versionType": "git"}, {"lessThan": "6890e28840bae4f6805e8de981c4ec8e12a4e064", "status": "affected", "version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "versionType": "git"}, {"lessThan": "feab9261b537df4ebb8350e4779bc185373059fd", "status": "affected", "version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "versionType": "git"}, {"lessThan": "f594f04268d01c5fdc975f3f51fc219ea2159ac6", "status": "affected", "version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "versionType": "git"}, {"lessThan": "d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f", "status": "affected", "version": "7801db8aec957fa6610efe0ee26a6c8bc0f1d73b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/cls_u32.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"lessThan": "3.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: fix duplicate handle when node ID pool is exhausted\n\ngen_new_kid() falls back to returning max (htid | 0xFFF) when both\nidr_alloc_u32() ranges are full, instead of reporting an error.\nu32_change() trusts that value and inserts a new knode with a handle\nthat is already live in the hash table, breaking handle uniqueness\nwithin the table's node ID space.\n\nThe handle was never reserved in ht->handle_idr, so every later error\npath that does idr_remove(&ht->handle_idr, handle) removes the\nreservation of a different, live knode, which is then reused \u2014 one\nfailed add compounds into further duplicates.\n\nThe 4095 limit is per (table, bucket) \u2014 ht->handle_idr is per hash\ntable and the range is derived from htid (bucketid), so a table with\ndivisor 256 can legitimately hold 256*4095 knodes.\n\nThe sibling helper gen_new_htid() has the same silent in-band failure:\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and\nu32_init() publishes the root hash table with handle 0 without\nchecking. Two root tables with handle 0 alias in u32_lookup_ht(),\nallowing cross-tcf_proto knode add/lookup/delete. Add the same\nexhaustion check that the divisor path already has.\n\nReturn an error so u32_change() fails with ENOSPC/ENOMEM when the\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM\nwhen the hash table ID space is exhausted. The extack message\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation\nfailure (-ENOMEM).\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded)\n- Create a clsact qdisc on a device, then add 4095 u32 filters with\n auto-generated handles to fill the node ID space for the root hash\n table (single bucket). The 4096th auto-handle filter add triggers\n the duplicate handle (fh 800::fff reused). Reachable at Level 2\n (unshare -Urn, namespace-local CAP_NET_ADMIN).\n- For gen_new_htid: create 2047 u32 proto entries on the same block\n to fill the tp_c handle pool, then create one more. The root table\n gets handle 0 and aliases with other handle-0 root tables."}], "id": "CVE-2026-98104", "lastModified": "2026-10-19T10:18:07.770", "metrics": {}, "published": "2026-09-25T11:17:40.793", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6890e28840bae4f6805e8de981c4ec8e12a4e064"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/84223baf21bc9b008444ae9bc38d5fb91fe00b9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f4ee13ed7f7b22dcd8287fcf477ae37bd84567da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f594f04268d01c5fdc975f3f51fc219ea2159ac6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/feab9261b537df4ebb8350e4779bc185373059fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted", "id": "2541362", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541362"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-392", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: cls_u32: fix duplicate handle when node ID pool is exhausted\ngen_new_kid() falls back to returning max (htid | 0xFFF) when both\nidr_alloc_u32() ranges are full, instead of reporting an error.\nu32_change() trusts that value and inserts a new knode with a handle\nthat is already live in the hash table, breaking handle uniqueness\nwithin the table's node ID space.\nThe handle was never reserved in ht->handle_idr, so every later error\npath that does idr_remove(&ht->handle_idr, handle) removes the\nreservation of a different, live knode, which is then reused \u2014 one\nfailed add compounds into further duplicates.\nThe 4095 limit is per (table, bucket) \u2014 ht->handle_idr is per hash\ntable and the range is derived from htid (bucketid), so a table with\ndivisor 256 can legitimately hold 256*4095 knodes.\nThe sibling helper gen_new_htid() has the same silent in-band failure:\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and\nu32_init() publishes the root hash table with handle 0 without\nchecking. Two root tables with handle 0 alias in u32_lookup_ht(),\nallowing cross-tcf_proto knode add/lookup/delete. Add the same\nexhaustion check that the divisor path already has.\nReturn an error so u32_change() fails with ENOSPC/ENOMEM when the\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM\nwhen the hash table ID space is exhausted. The extack message\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation\nfailure (-ENOMEM).\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded)\n- Create a clsact qdisc on a device, then add 4095 u32 filters with\nauto-generated handles to fill the node ID space for the root hash\ntable (single bucket). The 4096th auto-handle filter add triggers\nthe duplicate handle (fh 800::fff reused). Reachable at Level 2\n(unshare -Urn, namespace-local CAP_NET_ADMIN).\n- For gen_new_htid: create 2047 u32 proto entries on the same block\nto fill the tp_c handle pool, then create one more. The root table\ngets handle 0 and aliases with other handle-0 root tables.", "A flaw was found in the Linux kernel's network traffic control u32 classifier (cls_u32). This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS). When the pool of internal identifiers for filters or hash tables is exhausted, the kernel fails to report an error and instead reuses existing identifiers. This duplicate identifier assignment corrupts internal kernel tables, which can result in system instability or a kernel crash."], "name": "CVE-2026-98104", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98104\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98104\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98104.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7801db8aec957fa6610efe0ee26a6c8bc0f1d73b,6890e28840bae4f6805e8de981c4ec8e12a4e064)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7801db8aec957fa6610efe0ee26a6c8bc0f1d73b,feab9261b537df4ebb8350e4779bc185373059fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7801db8aec957fa6610efe0ee26a6c8bc0f1d73b,f594f04268d01c5fdc975f3f51fc219ea2159ac6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7801db8aec957fa6610efe0ee26a6c8bc0f1d73b,d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T12:45:17.072779+00:00", "updated": "2026-09-30T13:45:16.960346+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}