---
id: CVE-2026-97598
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: fib: bound automatic table ID allocation

  fib_empty_table() probes every table ID from 1 until it finds a
  free one
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: fib: bound automatic table ID allocation

  fib_empty_table() probes every table ID from 1 until it finds a
  free one.  IPv4 tables are stored in a 256-bucket hash t…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    999bc00588cb305ab25065e8a8ac31da7465301c
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    125890702ef4417cd0ffac2e448c0cd4fbf0ac45
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    3080f9e653d8c057d5652db5ced8137f81b3fcbd
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    bc8d01d856db106f284b19961af6112e10c3e3b4
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    fe9a906d2bff2d2707bafd6353b5e032a42aeb35
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503
  - >-
    Linux >= b801f54917b7c6e8540f877ee562cd0725e62ebd <
    efdfb1e27a3328085b79540dfe781d537b576ea1
  - Linux 2.6.19
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:06.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97598'
references:
  - url: 'https://git.kernel.org/stable/c/125890702ef4417cd0ffac2e448c0cd4fbf0ac45'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2c29c053a6627dc4f12fcfe6b4860bcd9e5d7503'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3080f9e653d8c057d5652db5ced8137f81b3fcbd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/999bc00588cb305ab25065e8a8ac31da7465301c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc8d01d856db106f284b19961af6112e10c3e3b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/efdfb1e27a3328085b79540dfe781d537b576ea1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fe9a906d2bff2d2707bafd6353b5e032a42aeb35'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97598.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97598'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541301'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97598'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97598'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97598.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00211
epssPercentile: 0.11204
ingestedAt: '2026-09-25T11:06:38.904Z'
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-770
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: bound automatic table ID allocation

fib_empty_table() probes every table ID from 1 until it finds a
free one.  IPv4 tables are stored in a 256-bucket hash table, so a
dense set of IDs makes each probe walk a growing hash chain while
RTNL is held.

Automatic table assignment ("ip rule ... table 0") is an IPv4-only
legacy path.  Bound the automatically allocated ID to 4096 so the
RTNL hold stays bounded, without changing lookups of explicitly
specified table IDs.

This changes user-visible behavior.  A table-0 rule previously
received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF).  After
this patch the search stops at 4096 and the rule add fails with
ENOBUFS if that range is fully occupied.  Explicit table IDs above
4096 remain usable.

The automatic path is unused in practice: it is IPv4-only, not
documented by ip-rule, uncovered by kernel selftests, and both
NetworkManager and systemd refuse table 0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97598.json)