CVE-2026-97958
Description
A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by sending repeated netlink queries to inspect network traffic control chains without reading the responses. When the socket buffer fills, the kernel incorrectly retries the operation in an unbounded loop. This flaw can exhaust system CPU resources and cause the system to become unresponsive.
Statement
A low impact denial of service (DoS) flaw was found in the Linux kernel's traffic control subsystem, in tc_ctl_chain() in net/sched/cls_api.c. The kernels shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the real-time kernel), Red Hat In-Vehicle OS, and the RHEL CoreOS builds used by OpenShift 4 and OpenShift 5 are affected. A local user with a low-privilege account can repeatedly send RTM_GETCHAIN netlink requests to inspect traffic control chains without reading the responses; once the netlink socket's receive buffer is full, netlink_attachskb() returns -EAGAIN and the kernel incorrectly replays the operation in an unbounded loop while holding the RTNL mutex. This can exhaust CPU and leave the system unresponsive (hung task), affecting only availability, with no impact on confidentiality or integrity. Although the CVSS:3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate), Red Hat rates the impact of this issue as low because exploitation requires local access and results only in a local denial of service. Red Hat Enterprise Linux 7 is marked not affected because the vulnerable code is not present in those kernels.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
