CVE-2026-97598
Received Received - Intake

Fib Table ID Allocation Bounds in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fib_empty_table() probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash chain while RTNL is held. Automatic table assignment ("ip rule ... table 0") is an IPv4-only legacy path. Bound the automatically allocated ID to 4096 so the RTNL hold stays bounded, without changing lookups of explicitly specified table IDs. This changes user-visible behavior. A table-0 rule previously received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After this patch the search stops at 4096 and the rule add fails with ENOBUFS if that range is fully occupied. Explicit table IDs above 4096 remain usable. The automatic path is unused in practice: it is IPv4-only, not documented by ip-rule, uncovered by kernel selftests, and both NetworkManager and systemd refuse table 0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97598
EUVD
EUVD-2026-86729

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the automatic table ID allocation for IPv4 routing. The system probes table IDs from 1 upward until finding a free one, but with dense IDs, this causes long hash chain walks while holding the RTNL lock, potentially leading to performance issues or deadlocks.

Detection Guidance

This vulnerability is related to IPv4 routing table ID allocation in the Linux kernel. Detection requires checking kernel logs for fib_empty_table() errors or examining routing rules with table 0. Use commands like 'dmesg | grep fib_empty_table' or 'ip rule show' to inspect rules. If table 0 rules exist, they may indicate potential issues.

Impact Analysis

The vulnerability may cause system slowdowns or crashes if IPv4 routing tables are densely populated. However, automatic table assignment is rarely used in practice, and modern tools like NetworkManager and systemd avoid it, reducing real-world impact.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-97598. Review and remove any existing IPv4 routing rules using table 0, as these are legacy and unused in practice. Monitor system logs for related errors after applying updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart