CVE-2026-97598
Description
A flaw was found in the Linux kernel's IPv4 routing subsystem. This vulnerability allows a local user with network configuration privileges to cause a Denial of Service (DoS). When automatic routing table identifier allocation is requested, the kernel searches through table identifiers without an upper bound while holding the internal Routing Netlink (RTNL) lock. By repeatedly triggering this automatic allocation, an attacker can cause severe lock contention and kernel processing delays that make network management unresponsive.
Statement
A moderate severity flaw was found in the Linux kernel IPv4 routing (FIB) subsystem in Red Hat Enterprise Linux and other affected Red Hat products, including RHEL 6 through 10 (kernel and kernel-rt), RHIVOS kernels, and OpenShift RHEL CoreOS kernels. When an IPv4 policy rule requests automatic routing table identifier allocation (for example "ip rule ... table 0"), the kernel searches for a free table identifier without an upper bound while holding the global routing netlink (RTNL) lock. A local user with network configuration privileges (CAP_NET_ADMIN) can repeatedly trigger this automatic allocation to cause severe RTNL lock contention and kernel processing delays, making network management unresponsive and resulting in a denial of service. The impact is limited to availability; there is no impact on confidentiality or integrity. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Fixes for all currently affected Red Hat products are deferred: the vulnerable automatic table allocation path is an IPv4-only legacy path that is not documented, is not used in practice (NetworkManager and systemd both refuse table 0), and is only reachable by a privileged local user, while the upstream fix changes user-visible behavior of that path. The residual risk is that a local user who already holds network administration privileges can consume kernel CPU and degrade network control-plane responsiveness on an affected host.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
