CVE-2026-97598

CVE CVE-2026-97598EUVD EUVD-2026-86729Published 2026-09-25T10:22:12.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fib_empty_table() probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash chain while RTNL is held. Automatic table assignment ("ip rule ... table 0") is an IPv4-only legacy path. Bound the automatically allocated ID to 4096 so the RTNL hold stays bounded, without changing lookups of explicitly specified table IDs. This changes user-visible behavior. A table-0 rule previously received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After this patch the search stops at 4096 and the rule add fails with ENOBUFS if that range is fully occupied. Explicit table IDs above 4096 remain usable. The automatic path is unused in practice: it is IPv4-only, not documented by ip-rule, uncovered by kernel selftests, and both NetworkManager and systemd refuse table 0.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 7.3-rc3; patch: 6.18.53; 2.6.19; b801f54917b7c6e8540f877ee562cd0725e62ebd <fe9a906d2bff2d2707bafd6353b5e032a42aeb35; b801f54917b7c6e8540f877ee562cd0725e62ebd <2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503; patch: 6.12.111; b801f54917b7c6e8540f877ee562cd0725e62ebd <bc8d01d856db106f284b19961af6112e10c3e3b4; patch: 7.2.7; patch: 0; b801f54917b7c6e8540f877ee562cd0725e62ebd <efdfb1e27a3328085b79540dfe781d537b576ea1

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.