CVE-2026-97959

Received Received - Intake

Memory Leak in Linux Kernel cls_route Filter

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: free emptied bucket on filter move route4_change can move an existing filter to a different top-level bucket: route4_set_parms recomputes the handle from TCA_ROUTE4_TO/ FROM/IIF, and the handle-mismatch check is gated on the 'new' flag, so for an existing filter the new handle may differ from the old one and land in a different bucket. When this happens, the filter is unlinked from the old bucket, but the bucket itself is never freed once it goes empty. The stale empty bucket remains in head->table[], causing route4_delete to report *last=false even after the last live filter is gone. That pins the empty tcf_proto and causes a leak. Fix this by refcounting the filters linked to a bucket and freeing the bucket when the count drops to zero. The existing scan in route4_delete goes away with it. The count is updated at all sites that link or unlink a filter during add, change and delete, and the bucket is dropped from head->table[] as soon as it reaches zero. Conditions to recreate the bug: CONFIG_NET_CLS_ROUTE4=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_NET_CLS_ACT=y. tc qdisc replace dev lo clsact tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1 tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \ route from 1 to 2 tc filter del dev lo ingress protocol ip pref 100 handle 0x10002 \ route from 1 to 2 tc filter show dev lo ingress | grep -c 'pref 100 route chain 0 '

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97959

EUVD

EUVD-2026-86813

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the traffic control subsystem. When a filter is moved to a different bucket in the route4 classifier, the old empty bucket is not freed, causing the bucket to remain in memory even after all filters are removed. This pins the empty tcf_proto structure and leads to a resource leak.

Detection Guidance

To detect this vulnerability, check for stale empty buckets in the Linux kernel's route4 classifier. Run these commands to reproduce the conditions and verify the issue: tc qdisc replace dev lo clsact; tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1; tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 route from 1 to 2; tc filter del dev lo ingress protocol ip pref 100 handle 0x10002 route from 1 to 2; tc filter show dev lo ingress | grep -c 'pref 100 route chain 0'.

If the count remains non-zero after deletion, the bucket is not being freed properly, indicating the vulnerability.

Impact Analysis

The vulnerability can cause memory leaks in the Linux kernel, potentially leading to system instability or reduced performance over time. It may exhaust memory resources if filters are frequently moved or deleted in affected configurations.

Compliance Impact

This vulnerability causes memory leaks in the Linux kernel's traffic control subsystem, specifically in the cls_route filter mechanism. While it does not directly impact data privacy or security controls required by standards like GDPR or HIPAA, it could lead to resource exhaustion or instability in network filtering services that process sensitive data. Such instability might indirectly affect compliance by disrupting logging, monitoring, or access control functions.

Mitigation Strategies

Apply the Linux kernel patch that fixes the bucket refcounting issue. Ensure CONFIG_NET_CLS_ROUTE4, CONFIG_NET_SCH_INGRESS, and CONFIG_NET_CLS_ACT are enabled and properly configured.

Hi! I’m here to help you understand CVE-2026-97959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70