Vulnerability-Lookup

FKIE_CVE-2026-97598

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 11:17

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fib_empty_table() probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash chain while RTNL is held. Automatic table assignment ("ip rule ... table 0") is an IPv4-only legacy path. Bound the automatically allocated ID to 4096 so the RTNL hold stays bounded, without changing lookups of explicitly specified table IDs. This changes user-visible behavior. A table-0 rule previously received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After this patch the search stops at 4096 and the rule add fails with ENOBUFS if that range is fully occupied. Explicit table IDs above 4096 remain usable. The automatic path is unused in practice: it is IPv4-only, not documented by ip-rule, uncovered by kernel selftests, and both NetworkManager and systemd refuse table 0.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc8d01d856db106f284b19961af6112e10c3e3b4",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "fe9a906d2bff2d2707bafd6353b5e032a42aeb35",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "efdfb1e27a3328085b79540dfe781d537b576ea1",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: bound automatic table ID allocation\n\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one.  IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\n\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path.  Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\n\nThis changes user-visible behavior.  A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF).  After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied.  Explicit table IDs above\n4096 remain usable.\n\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0."
    }
  ],
  "id": "CVE-2026-97598",
  "lastModified": "2026-09-25T11:17:11.130",
  "metrics": {},
  "published": "2026-09-25T11:17:11.130",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-97598 (GCVE-0-2026-97598)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 10:22

Title

ipv4: fib: bound automatic table ID allocation

Summary

Severity

No CVSS data available.

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/bc8d01d856db106f2…
https://git.kernel.org/stable/c/fe9a906d2bff2d270…
https://git.kernel.org/stable/c/2c29c053a6627dc4f…
https://git.kernel.org/stable/c/efdfb1e27a3328085…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b801f54917b7c6e8540f877ee562cd0725e62ebd , < bc8d01d856db106f284b19961af6112e10c3e3b4 (git) Affected: b801f54917b7c6e8540f877ee562cd0725e62ebd , < fe9a906d2bff2d2707bafd6353b5e032a42aeb35 (git) Affected: b801f54917b7c6e8540f877ee562cd0725e62ebd , < 2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503 (git) Affected: b801f54917b7c6e8540f877ee562cd0725e62ebd , < efdfb1e27a3328085b79540dfe781d537b576ea1 (git)
Linux	Linux	Affected: 2.6.19 Unaffected: 0 , < 2.6.19 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc8d01d856db106f284b19961af6112e10c3e3b4",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "fe9a906d2bff2d2707bafd6353b5e032a42aeb35",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            },
            {
              "lessThan": "efdfb1e27a3328085b79540dfe781d537b576ea1",
              "status": "affected",
              "version": "b801f54917b7c6e8540f877ee562cd0725e62ebd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: bound automatic table ID allocation\n\nfib_empty_table() probes every table ID from 1 until it finds a\nfree one.  IPv4 tables are stored in a 256-bucket hash table, so a\ndense set of IDs makes each probe walk a growing hash chain while\nRTNL is held.\n\nAutomatic table assignment (\"ip rule ... table 0\") is an IPv4-only\nlegacy path.  Bound the automatically allocated ID to 4096 so the\nRTNL hold stays bounded, without changing lookups of explicitly\nspecified table IDs.\n\nThis changes user-visible behavior.  A table-0 rule previously\nreceived the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF).  After\nthis patch the search stops at 4096 and the rule add fails with\nENOBUFS if that range is fully occupied.  Explicit table IDs above\n4096 remain usable.\n\nThe automatic path is unused in practice: it is IPv4-only, not\ndocumented by ip-rule, uncovered by kernel selftests, and both\nNetworkManager and systemd refuse table 0."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T10:22:12.972Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503"
        },
        {
          "url": "https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1"
        }
      ],
      "title": "ipv4: fib: bound automatic table ID allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97598",
    "datePublished": "2026-09-25T10:22:12.972Z",
    "dateReserved": "2026-09-24T16:01:01.157Z",
    "dateUpdated": "2026-09-25T10:22:12.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-97598

CVE-2026-97598 (GCVE-0-2026-97598)

Tags

Sightings

Nomenclature

Related by attack behaviour