CVE-2026-98104

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted

gen_new_kid() falls back to returning max (htid | 0xFFF) when both

idr_alloc_u32() ranges are full, instead of reporting an error.

u32_change() trusts that value and inserts a new knode with a handle

that is already live in the hash table, breaking handle uniqueness

within the table's node ID space.

The handle was never reserved in ht->handle_idr, so every later error

path that does idr_remove(&ht->handle_idr, handle) removes the

reservation of a different, live knode, which is then reused — one

failed add compounds into further duplicates.

The 4095 limit is per (table, bucket) — ht->handle_idr is per hash

table and the range is derived from htid (bucketid), so a table with

divisor 256 can legitimately hold 256*4095 knodes.

The sibling helper gen_new_htid() has the same silent in-band failure:

it returns 0 when the tp_c handle pool (1..0x7FF)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References