{"id":41101,"date":"2026-10-19T00:32:09","date_gmt":"2026-10-18T16:32:09","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98629"},"modified":"2026-10-19T00:32:09","modified_gmt":"2026-10-18T16:32:09","slug":"cve-2026-98629","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98629","title":{"rendered":"CVE-2026-98629 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/sched: cls_u32: f"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: cls_u32: fix manual hash table handle IDR aliasing<\/p>\n<p>A u32 hash table created with an explicit handle (&#8216;tc filter add &#8230;<br \/>\nhandle 801: u32 divisor N&#8217;) keys its IDR entry on the raw handle, while<br \/>\nthe destroy paths free it under handle2id(handle). The two key domains<br \/>\ndisagree for handles in the 0x800..0xFFF htid range:<br \/>\nhandle2id() folds them back into the auto-allocated id space (1..0x7FF).<\/p>\n<p>A manual table therefore leaves its raw-keyed IDR entry unreachable on<br \/>\ndelete (a permanent leak), and its delete can drop the idr entry of an<br \/>\nunrelated live auto table. A later auto allocation can then hand out a<br \/>\nhandle that aliases the live manual table; u32_lookup_ht() first-match<br \/>\nroutes lookups and TCA_U32_LINK for that htid to the wrong table.<\/p>\n<p>Key the divisor-path alloc on handle2id(handle) so allocation and<br \/>\nremoval share one key domain. A manual handle that maps onto an id<br \/>\nalready in use is rejected with -ENOSPC, and auto allocation skips ids<br \/>\nheld by live manual tables.<\/p>\n<p>Conditions to recreate:<br \/>\n  ip link add test0 type dummy<br \/>\n  tc qdisc add dev test0 clsact<br \/>\n  tc filter add dev test0 ingress protocol ip pref 1<br \/>\n          handle 801: u32 divisor 16<br \/>\n  tc filter add dev test0 ingress protocol ip pref 2 u32 divisor 16<br \/>\n  tc -d filter show dev test0 ingress | grep &#8216;fh 801:&#8217;<br \/>\n  # unpatched: two live tables with handle 0x80100000 (the pref 2 root<br \/>\n  # hnode is auto-allocated id 1); patched: the auto hnode takes id 2.<\/p>\n<p>Also tested with a poc with a live u32 table on the block, add\/delete a manual<br \/>\ntable &#8216;handle 901: u32 divisor 1&#8217; twice; unpatched, the re-add fails with<br \/>\n-ENOSPC because the raw key leaked on the first delete.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/sched: cls_u32: fix manual hash table handle IDR aliasing<\/p>\n<p>A u32 hash table created with an explicit handle (&#8216;tc filter add &#8230;<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41101","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}