CVE-2026-97598 (GCVE-0-2026-97598)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-19 09:10
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fib_empty_table() probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash chain while RTNL is held. Automatic table assignment ("ip rule ... table 0") is an IPv4-only legacy path. Bound the automatically allocated ID to 4096 so the RTNL hold stays bounded, without changing lookups of explicitly specified table IDs. This changes user-visible behavior. A table-0 rule previously received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After this patch the search stops at 4096 and the rule add fails with ENOBUFS if that range is fully occupied. Explicit table IDs above 4096 remain usable. The automatic path is unused in practice: it is IPv4-only, not documented by ip-rule, uncovered by kernel selftests, and both NetworkManager and systemd refuse table 0.
References
Impacted products
Vendor Product Version
Linux Linux Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
Version: b801f54917b7c6e8540f877ee562cd0725e62ebd
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "999bc00588cb305ab25065e8a8ac31da7465301c",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "125890702ef4417cd0ffac2e448c0cd4fbf0ac45",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "3080f9e653d8c057d5652db5ced8137f81b3fcbd",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "bc8d01d856db106f284b19961af6112e10c3e3b4",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "fe9a906d2bff2d2707bafd6353b5e032a42aeb35",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "efdfb1e27a3328085b79540dfe781d537b576ea1",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: bound automatic table ID allocation\n\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one.  IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\n\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path.  Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\n\nThis changes user-visible behavior.  A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF).  After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied.  Explicit table IDs above\n4096 remain usable.\n\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:10:02.029Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/999bc00588cb305ab25065e8a8ac31da7465301c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/125890702ef4417cd0ffac2e448c0cd4fbf0ac45"
        },
        {
          "url": "https://git.kernel.org/stable/c/3080f9e653d8c057d5652db5ced8137f81b3fcbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503"
        },
        {
          "url": "https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1"
        }
      ],
      "title": "ipv4: fib: bound automatic table ID allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97598",
    "datePublished": "2026-09-25T10:22:12.972Z",
    "dateReserved": "2026-09-24T16:01:01.157Z",
    "dateUpdated": "2026-10-19T09:10:02.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.