CVE-2026-98104: net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
In the Linux kernel, the following vulnerability has been resolved:
net/sched: clsu32: fix duplicate handle when node ID pool is exhausted
gennewkid() falls back to returning max (htid | 0xFFF) when both idrallocu32() ranges are full, instead of reporting an error. u32change() trusts that value and inserts a new knode with a handle that is already live in the hash table, breaking handle uniqueness within the table's node ID space.
The handle was never reserved in ht->handleidr, so every later error path that does idrremove(&ht->handleidr, handle) removes the reservation of a different, live knode, which is then reused — one failed add compounds into further duplicates.
The 4095 limit is per (table, bucket) — ht->handleidr is per hash table and the range is derived from htid (bucketid), so a table with divisor 256 can legitimately hold 2564095 knodes.
The sibling helper gennewhtid() has the same silent in-band failure: it returns 0 when the tpc handle pool (1..0x7FF) is full, and u32init() publishes the root hash table with handle 0 without checking. Two root tables with handle 0 alias in u32lookupht(), allowing cross-tcfproto knode add/lookup/delete. Add the same exhaustion check that the divisor path already has.
Return an error so u32change() fails with ENOSPC/ENOMEM when the node ID space is exhausted, and so u32init() fails with -ENOMEM when the hash table ID space is exhausted. The extack message distinguishes pool exhaustion (-ENOSPC) from a transient allocation failure (-ENOMEM).
Conditions to recreate the bug: - CONFIGNETSCHED=y, CONFIGCLSU32=y (or =m with module loaded) - Create a clsact qdisc on a device, then add 4095 u32 filters with auto-generated handles to fill the node ID space for the root hash table (single bucket). The 4096th auto-handle filter add triggers the duplicate handle (fh 800::fff reused). Reachable at Level 2 (unshare -Urn, namespace-local CAPNETADMIN). - For gennewhtid: create 2047 u32 proto entries on the same block to fill the tpc handle pool, then create one more. The root table gets handle 0 and aliases with other handle-0 root tables.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the duplicate node-handle issue?
An affected cls_u32 hash table must exhaust the node ID allocation ranges for a bucket. The flawed fallback then uses the bucket's maximum node ID even when that handle is already assigned, allowing a new knode to be inserted with a duplicate handle.
What conditions are required for the root hash-table handle aliasing issue?
The tp_c handle pool must be exhausted. When that occurs, the helper returns handle 0 and u32_init() can publish a root hash table with that unvalidated handle, so two root tables using handle 0 can alias during lookup.
What can happen after a failed knode addition in an exhausted node-ID pool?
Because the duplicate handle was not reserved in ht->handle_idr, later error cleanup can remove the reservation belonging to a different live knode. That released handle can then be reused, causing additional duplicate handles after a single failed add.
How large can a cls_u32 table become before the per-bucket node limit is relevant?
The 4095-node limit applies per table and bucket, not to the entire hash table. For example, a table with divisor 256 can legitimately contain 256 multiplied by 4095 knodes.