VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-97598: Linux kernel · ipv4: fib: bound automatic table ID allocation

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fe9a906d2bff2d2707bafd6353b5e032a42aeb35 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:38 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fe9a906d2bff2d2707bafd6353b5e032a42aeb35, f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6, efdfb1e27a3328085b79540dfe781d537b576ea1 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ b801f54917b7c6e8540f877ee562cd0725e62ebd, < fe9a906d2bff2d2707bafd6353b5e032a42aeb35	Fixed in fe9a906d2bff2d2707bafd6353b5e032a42aeb35
LinuxLinux	Affected ≥ b801f54917b7c6e8540f877ee562cd0725e62ebd, < f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6	Fixed in f1f2da33eaab54b4d5cdea6d70befb2e2fb49cb6
LinuxLinux	Affected ≥ b801f54917b7c6e8540f877ee562cd0725e62ebd, < efdfb1e27a3328085b79540dfe781d537b576ea1	Fixed in efdfb1e27a3328085b79540dfe781d537b576ea1
LinuxLinux	Affected ≥ b801f54917b7c6e8540f877ee562cd0725e62ebd, < bc8d01d856db106f284b19961af6112e10c3e3b4	Fixed in bc8d01d856db106f284b19961af6112e10c3e3b4
LinuxLinux	Affected ≥ b801f54917b7c6e8540f877ee562cd0725e62ebd, < 125890702ef4417cd0ffac2e448c0cd4fbf0ac45	Fixed in 125890702ef4417cd0ffac2e448c0cd4fbf0ac45
LinuxLinux	Affected ≥ b801f54917b7c6e8540f877ee562cd0725e62ebd, < 3080f9e653d8c057d5652db5ced8137f81b3fcbd	Fixed in 3080f9e653d8c057d5652db5ced8137f81b3fcbd

AI-suggested

A fix is available and has been applied in the Linux kernel at the specified commits. Users should update to a kernel version including these fixes to resolve the issue. Since the automatic table ID allocation path is legacy and unused by common tools, no additional mitigation is typically required.

Description

CVE-2026-97598 addresses a vulnerability in the Linux kernel's IPv4 routing table ID allocation mechanism. The automatic allocation of table IDs for IPv4 rules previously searched the entire range up to RT_TABLE_MAX (0xFFFFFFFF), potentially causing unbounded delays while holding the RTNL lock. The fix bounds this search to 4096, limiting the lock hold duration and changing user-visible behavior by causing rule addition to fail with ENOBUFS if the range is exhausted. This automatic allocation path is legacy, IPv4-only, undocumented, and unused by major components like NetworkManager and systemd.

Impact

The impact is primarily a denial of service risk due to unbounded RTNL lock hold times during automatic IPv4 table ID allocation. The fix limits the search range, bounding the lock hold duration and preventing potential performance degradation. The change also causes rule addition failures with ENOBUFS if the limited range is exhausted, which could affect legacy or uncommon configurations relying on automatic table ID assignment. However, since this automatic path is legacy, IPv4-only, undocumented, and unused by major tools like NetworkManager and systemd, practical impact is minimal.

Summary

The vulnerability involves the fib_empty_table() function in the Linux kernel, which probes every table ID from 1 upwards to find a free one for automatic IPv4 routing table assignment. Because IPv4 tables are stored in a 256-bucket hash table, a dense set of IDs causes each probe to traverse a growing hash chain while the RTNL lock is held, potentially leading to performance degradation or denial of service. The patch bounds the automatic table ID search to 4096, preventing unbounded RTNL lock hold times. This change alters behavior by limiting automatic table ID allocation to IDs below 4096 and causing rule addition failures if no free ID is found in that range. Explicit table IDs above 4096 remain unaffected. The automatic allocation path is legacy and not used in practice by major Linux networking components.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:38 UTC

Technical details

References

Community reviews

Related threats