CVE-2026-98104

A Moderate impact flaw was found in the Linux kernel's network traffic control u32 classifier (net/sched/cls_u32.c), affecting the kernels shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS). When a hash table's node ID pool or the hash table ID pool is exhausted, the gen_new_kid() and gen_new_htid() helpers fail to report an error and instead return an already-live handle or handle 0. This produces duplicate u32 filter handles, aliases root hash tables, and corrupts internal classifier bookkeeping, and subsequent error paths can then remove the ID reservation of a different, live node, compounding the duplicates. A local user with network administration privileges in a network namespace, which an unprivileged local user can obtain through unprivileged user namespaces (unshare -Urn), can trigger this by creating thousands of u32 filters or protocol entries, causing kernel instability or a crash (denial of service). Only availability is affected (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); there is no impact on confidentiality or integrity. Because the flaw is a moderate-severity, local denial of service requiring local access with namespace-level network administration privileges, fixes for the affected Red Hat products are currently deferred; the residual risk of deferral is that such a local user can crash an affected system. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this issue. The upstream Linux kernel CVE team has assigned no severity rating for this issue, so no comparison to an upstream severity is applicable.