CVE-2026-97959— net/sched: cls_route: free emptied bucket on filter move
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： net/sched: cls_route: 在过滤器迁移时释放已清空的数据桶 可以将现有过滤器移动到一个不同的顶层数据桶（bucket）中： 会根据 重新计算句柄（handle），而句柄不匹配的检查被 标志所控制。因此，对于已存在的过滤器，新句柄可能与旧句柄不同，从而落入不同的数据桶中。当这种情况发生时，过滤器会从旧的数据桶中解链，但该数据桶一旦变为空便从未被释放。残留的空数据桶仍保留在 中，导致 即使在最后一个活跃过滤器移除后仍报告 。这会锁定（pin）空的 ，从而造
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1e052be69d045c8d0f82ff1116fd3e5a79661745< 9e7741b41a25b9d49df4d262fa314342e6f95c50 |
affected |
1e052be69d045c8d0f82ff1116fd3e5a79661745< 48d38bf8c22a05fde07ba1f885cde27b851649a2 |
affected | ||
1e052be69d045c8d0f82ff1116fd3e5a79661745< cc99d26b12431e4e4d0e346ec32764eb42c0aed9 |
affected | ||
1e052be69d045c8d0f82ff1116fd3e5a79661745< 41e94079200aaf0cdbe4594b0af75710b33da124 |
affected | ||
1e052be69d045c8d0f82ff1116fd3e5a79661745< 2e2f130951d34871b0643bf700164d97cff4b427 |
affected | ||
1e052be69d045c8d0f82ff1116fd3e5a79661745< f8495d67434e1cb7e511297687ca55fdb28e4c20 |
affected | ||
1e052be69d045c8d0f82ff1116fd3e5a79661745< 81dd117c04422c6d0c7974aba9fa6a0ba370959b |
affected | ||
1e052be69d045c8d0f82ff1116fd3e5a79661745< 1853f30cf5c84971f99788a76207c6f745380896 |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97959
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/sched: cls_route: free emptied bucket on filter move
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_route: free emptied bucket on filter move
route4_change can move an existing filter to a different top-level
bucket: route4_set_parms recomputes the handle from TCA_ROUTE4_TO/
FROM/IIF, and the handle-mismatch check is gated on the 'new' flag, so
for an existing filter the new handle may differ from the old one and
land in a different bucket. When this happens, the filter is unlinked
from the old bucket, but the bucket itself is never freed once it goes
empty. The stale empty bucket remains in head->table[], causing
route4_delete to report *last=false even after the last live filter is
gone. That pins the empty tcf_proto and causes a leak.
Fix this by refcounting the filters linked to a bucket and freeing the
bucket when the count drops to zero. The existing scan in route4_delete
goes away with it.
The count is updated at all sites that link or unlink a filter during add,
change and delete, and the bucket is dropped from head->table[] as soon as
it reaches zero.
Conditions to recreate the bug:
CONFIG_NET_CLS_ROUTE4=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_NET_CLS_ACT=y.
tc qdisc replace dev lo clsact
tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1
tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \
route from 1 to 2
tc filter del dev lo ingress protocol ip pref 100 handle 0x10002 \
route from 1 to 2
tc filter show dev lo ingress | grep -c 'pref 100 route chain 0 '
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-97959
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97959
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-97959 (8)
Same Patch Batch · Linux · 2026-09-25 · 372 CVEs total
| CVE-2026-100075 | 9.8 CRITICAL | RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters |
| CVE-2026-97555 | 8.8 HIGH | smb: client: fix heap overflow in DACL owner/group rewrite |
| CVE-2026-97957 | 8.8 HIGH | net: hinic: fix mailbox segment buffer overflow |
| CVE-2026-97527 | 8.8 HIGH | scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock |
| CVE-2026-97528 | 8.8 HIGH | scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error |
| CVE-2026-98115 | 8.8 HIGH | ksmbd: safely drain sessions during logoff |
| CVE-2026-97525 | 8.2 HIGH | x86/mm/pat: Allocate split page tables as kernel page tables |
| CVE-2026-98069 | 8.1 HIGH | net/rds: acquire the fastpath locks in rds_conn_shutdown() |
| CVE-2026-97573 | 8.1 HIGH | bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() |
| CVE-2026-97570 | 8.1 HIGH | bnxt_en: Bound SW TPA IDs to prevent crashes |
| CVE-2026-98130 | 8.1 HIGH | sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START |
| CVE-2026-98070 | 8.1 HIGH | net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() |
| CVE-2026-97941 | 7.8 HIGH | mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race |
| CVE-2026-97575 | 7.8 HIGH | media: v4l2-ctrls: validate AV1 tile counts |
| CVE-2026-97576 | 7.8 HIGH | media: v4l2-ctrls: validate HEVC tile counts |
| CVE-2026-98002 | 7.8 HIGH | iommu/amd: Fix ineffective error check in nested domain allocation |
| CVE-2026-98112 | 7.8 HIGH | ksmbd: fix listener task lifetime on netdev events |
| CVE-2026-97937 | 7.8 HIGH | ftrace: fork: Initialize function graph state before copy_exec_state() |
| CVE-2026-97580 | 7.8 HIGH | media: rkvdec: bound HEVC tile loops and PPS id to the array capacity |
| CVE-2026-97940 | 7.8 HIGH | ipv6: fix fib6 walker UAF on seq stop |
Showing top 20 of 372 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-97959
No comments yet