CVE-2026-97598 Linux CVE debrief

Who should care

Linux kernel administrators and deployers using automatic table assignment 'ip rule ... table 0' should assess exposure and verify if table-0 rules are in use and may be affected. This includes those managing Linux kernel deployments, reviewing kernel selftests, and verifying configurations for potential impacts on user-visible behavior for table-0 rules.

Why it matters

The Linux kernel vulnerability affects IPv4 fib table ID allocation. Assess exposure for Linux kernel deployments using automatic table assignment and verify if table-0 rules are in use and may be affected.

• Verify table-0 rule usage and potential failure
• Assess exposure for Linux kernel deployments
• Review kernel selftests and configurations

Technical summary

The Linux kernel has resolved a vulnerability in IPv4 fib table ID allocation by bounding automatic table assignment 'ip rule ... table 0' to 4096. This change prevents RTNL hold from growing unbounded and affects user-visible behavior for table-0 rules, which may now fail with ENOBUFS if the ID range is fully occupied. The change impacts IPv4 tables stored in a 256-bucket hash table, particularly for dense ID sets. Linux kernel administrators and deployers using automatic table assignment should assess exposure and verify if table-0 rules are in use.

Defensive priority

Assess exposure for Linux kernel deployments using automatic table assignment.

Recommended defensive actions

• Assess Linux kernel deployments for automatic table assignment usage
• Verify if table-0 rules are in use and may be affected
• Review kernel selftests and NetworkManager or systemd configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its resolution. The Linux kernel vulnerability affects IPv4 fib table ID allocation, with the automatic table assignment 'ip rule ... table 0' bounded to 4096. This change prevents RTNL hold from growing unbounded but may affect user-visible behavior for table-0 rules. Assess exposure for Linux kernel deployments using automatic table assignment and verify if table-0 rules are in use and may be affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.