{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-98629",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-98629",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-10-18T15:19:50.589Z",
    "updatedAt": "2026-10-19T09:22:57.219Z",
    "importedAt": "2026-10-24T01:58:41.756Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "net/sched: cls_u32: fix manual hash table handle IDR aliasing",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: fix manual hash table handle IDR aliasing\n\nA u32 hash table created with an explicit handle ('tc filter add ...\nhandle 801: u32 divisor N') keys its IDR entry on the raw handle, while\nthe destroy paths free it under handle2id(handle). The two key domains\ndisagree for handles in the 0x800..0xFFF htid range:\nhandle2id() folds them back into the auto-allocated id space (1..0x7FF).\n\nA manual table therefore leaves its raw-keyed IDR entry unreachable on\ndelete (a permanent leak), and its delete can drop the idr entry of an\nunrelated live auto table. A later auto allocation can then hand out a\nhandle that aliases the live manual table; u32_lookup_ht() first-match\nroutes lookups and TCA_U32_LINK for that htid to the wrong table.\n\nKey the divisor-path alloc on handle2id(handle) so allocation and\nremoval share one key domain. A manual handle that maps onto an id\nalready in use is rejected with -ENOSPC, and auto allocation skips ids\nheld by live manual tables.\n\nConditions to recreate:\n  ip link add test0 type dummy\n  tc qdisc add dev test0 clsact\n  tc filter add dev test0 ingress protocol ip pref 1 \\\n          handle 801: u32 divisor 16\n  tc filter add dev test0 ingress protocol ip pref 2 u32 divisor 16\n  tc -d filter show dev test0 ingress | grep 'fh 801:'\n  # unpatched: two live tables with handle 0x80100000 (the pref 2 root\n  # hnode is auto-allocated id 1); patched: the auto hnode takes id 2.\n\nAlso tested with a poc with a live u32 table on the block, add/delete a manual\ntable 'handle 901: u32 divisor 1' twice; unpatched, the re-add fails with\n-ENOSPC because the raw key leaked on the first delete.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9b2c3184e126b941dfa716b8128ed6db92a64e2f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "21fc07924e996e1e661268ca269c86b8d59d25b3"
            },
            {
              "version": "789f9963bd031c3a185605665b744912df8e7eda",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0fac292d93fdb313099e98cce928b3a524c92c94"
            },
            {
              "version": "73af53d82076bbe184d9ece9e14b0dc8599e6055",
              "status": "affected",
              "versionType": "git",
              "lessThan": "54a454c5e41f5e2cb70c8163140ce095c5d5eefd"
            },
            {
              "version": "73af53d82076bbe184d9ece9e14b0dc8599e6055",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f6696481eedfd5752b4b56eed715d0b0fe48b9c5"
            },
            {
              "version": "73af53d82076bbe184d9ece9e14b0dc8599e6055",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2f898f9ec7c73c5697ee462681e7ea6984ee1f3d"
            },
            {
              "version": "73af53d82076bbe184d9ece9e14b0dc8599e6055",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0a5f5d9e94dead312d32c366b917c64e552b72f7"
            },
            {
              "version": "4403f9293ce9ecc2a55c688d84ee37e3ba0fc1a8",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6.1.119",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.189"
            },
            {
              "version": "6.6.63",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.158"
            },
            {
              "version": "6.11.10",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.12",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.12"
            },
            {
              "version": "6.1.189",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.158",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.112",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.55",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.9",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}