CVE-2026-98104: net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted

In the Linux kernel, the following vulnerability has been resolved:

net/sched: clsu32: fix duplicate handle when node ID pool is exhausted

gennewkid() falls back to returning max (htid | 0xFFF) when both idrallocu32() ranges are full, instead of reporting an error. u32change() trusts that value and inserts a new knode with a handle that is already live in the hash table, breaking handle uniqueness within the table's node ID space.

The handle was never reserved in ht->handleidr, so every later error path that does idrremove(&ht->handleidr, handle) removes the reservation of a different, live knode, which is then reused — one failed add compounds into further duplicates.

The 4095 limit is per (table, bucket) — ht->handleidr is per hash table and the range is derived from htid (bucketid), so a table with divisor 256 can legitimately hold 2564095 knodes.

The sibling helper gennewhtid() has the same silent in-band failure: it returns 0 when the tpc handle pool (1..0x7FF) is full, and u32init() publishes the root hash table with handle 0 without checking. Two root tables with handle 0 alias in u32lookupht(), allowing cross-tcfproto knode add/lookup/delete. Add the same exhaustion check that the divisor path already has.

Return an error so u32change() fails with ENOSPC/ENOMEM when the node ID space is exhausted, and so u32init() fails with -ENOMEM when the hash table ID space is exhausted. The extack message distinguishes pool exhaustion (-ENOSPC) from a transient allocation failure (-ENOMEM).

Conditions to recreate the bug: - CONFIGNETSCHED=y, CONFIGCLSU32=y (or =m with module loaded) - Create a clsact qdisc on a device, then add 4095 u32 filters with auto-generated handles to fill the node ID space for the root hash table (single bucket). The 4096th auto-handle filter add triggers the duplicate handle (fh 800::fff reused). Reachable at Level 2 (unshare -Urn, namespace-local CAPNETADMIN). - For gennewhtid: create 2047 u32 proto entries on the same block to fill the tpc handle pool, then create one more. The root table gets handle 0 and aliases with other handle-0 root tables.