CVE-2026-97958

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by sending repeated netlink queries to inspect network traffic control chains without reading the responses. When the socket buffer fills, the kernel incorrectly retries the operation in an unbounded loop. This flaw can exhaust system CPU resources and cause the system to become unresponsive.

A low impact denial of service (DoS) flaw was found in the Linux kernel's traffic control subsystem, in tc_ctl_chain() in net/sched/cls_api.c. The kernels shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the real-time kernel), Red Hat In-Vehicle OS, and the RHEL CoreOS builds used by OpenShift 4 and OpenShift 5 are affected. A local user with a low-privilege account can repeatedly send RTM_GETCHAIN netlink requests to inspect traffic control chains without reading the responses; once the netlink socket's receive buffer is full, netlink_attachskb() returns -EAGAIN and the kernel incorrectly replays the operation in an unbounded loop while holding the RTNL mutex. This can exhaust CPU and leave the system unresponsive (hung task), affecting only availability, with no impact on confidentiality or integrity. Although the CVSS:3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate), Red Hat rates the impact of this issue as low because exploitation requires local access and results only in a local denial of service. Red Hat Enterprise Linux 7 is marked not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.