CVE-2026-98629

What it actually does

IDR key domain mismatch between raw handle and handle2id() for manual u32 divisor tables in 0x800-0xFFF range causes permanent IDR leaks on delete, accidental freeing of unrelated auto-allocated entries, and subsequent handle aliasing that makes u32_lookup_ht() route to the wrong table.

Why it matters to the business

Linux systems performing advanced traffic classification with tc u32 filters may experience kernel memory leaks, misclassified packets, or crashes when manual handles collide with auto-allocated ones, affecting network policy enforcement and stability.

How an attack unfolds

An attacker with CAP_NET_ADMIN creates a dummy interface and clsact qdisc, adds a manual u32 divisor table using a handle in the colliding range, then triggers delete/add sequences or concurrent auto allocations; the resulting alias causes lookups and TCA_U32_LINK actions to operate on the wrong table, enabling traffic misdirection or kernel instability.

How to fix it

Upgrade the Linux kernel to a version containing the fix that keys divisor-path allocations on handle2id(handle) and rejects colliding manual handles with -ENOSPC.

How to confirm the fix worked

After patching, repeat the provided reproduction commands; confirm that the auto-allocated hnode receives a non-colliding id and that repeated add/delete of manual tables succeeds without -ENOSPC.

Typical attack path

1. Obtain CAP_NET_ADMIN on target host
2. Create network device and clsact qdisc
3. Add manual u32 divisor table with handle in 0x800-0xFFF range
4. Add or delete additional u32 tables to trigger IDR aliasing
5. Observe or abuse resulting lookup misdirection or resource corruption

How to detect it

Inspect kernel logs for cls_u32 related warnings or -ENOSPC on filter operations; review tc -d filter show output for duplicate fh values or unexpected hnode ids; examine audit logs for privileged tc commands creating manual u32 tables.

• fh 801:.*u32 divisor
• handle 0x80100000
• u32_lookup_ht
• ENOSPC.*manual table

What your security team should do

• Prioritize kernel updates on systems that use tc u32 classifiers with explicit manual handles
• Audit tc filter configurations for manual divisor tables using handles 0x800: and above
• Monitor for unusual -ENOSPC errors or unexpected fh handle values in tc -d filter output