CVE-2026-98104

A flaw was found in the Linux kernel's network traffic control u32 classifier (cls_u32). This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS). When the pool of internal identifiers for filters or hash tables is exhausted, the kernel fails to report an error and instead reuses existing identifiers. This duplicate identifier assignment corrupts internal kernel tables, which can result in system instability or a kernel crash.

A Moderate impact flaw was found in the Linux kernel's network traffic control u32 classifier (net/sched/cls_u32.c), affecting the kernels shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS). When a hash table's node ID pool or the hash table ID pool is exhausted, the gen_new_kid() and gen_new_htid() helpers fail to report an error and instead return an already-live handle or handle 0. This produces duplicate u32 filter handles, aliases root hash tables, and corrupts internal classifier bookkeeping, and subsequent error paths can then remove the ID reservation of a different, live node, compounding the duplicates. A local user with network administration privileges in a network namespace, which an unprivileged local user can obtain through unprivileged user namespaces (unshare -Urn), can trigger this by creating thousands of u32 filters or protocol entries, causing kernel instability or a crash (denial of service). Only availability is affected (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); there is no impact on confidentiality or integrity. Because the flaw is a moderate-severity, local denial of service requiring local access with namespace-level network administration privileges, fixes for the affected Red Hat products are currently deferred; the residual risk of deferral is that such a local user can crash an affected system. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this issue. The upstream Linux kernel CVE team has assigned no severity rating for this issue, so no comparison to an upstream severity is applicable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.