{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98104 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98104 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98104 and fix it if it is affected.\n\nWhat it is: CVE-2026-98104 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98104 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98104/ (Markdown: https://insights.sbomify.com/CVE-2026-98104/index.md)","id":"CVE-2026-98104","markdown":"https://insights.sbomify.com/CVE-2026-98104/index.md","name":"CVE-2026-98104","record":{"aliases":["AZL-104472","BELL-CVE-2026-98104","DEBIAN-CVE-2026-98104","GHSA-5hrc-2j7x-qhwq","UBUNTU-CVE-2026-98104"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_modify","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A logic error in the Linux kernel's u32 classifier allows duplicate handles when node ID pools are exhausted, potentially causing data corruption or denial of service for local attackers with network administration capabilities.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: fix duplicate handle when node ID pool is exhausted\n\ngen_new_kid() falls back to returning max (htid | 0xFFF) when both\nidr_alloc_u32() ranges are full, instead of reporting an error.\nu32_change() trusts that value and inserts a new knode with a handle\nthat is already live in the hash table, breaking handle uniqueness\nwithin the table's node ID space.\n\nThe handle was never reserved in ht-\u003ehandle_idr, so every later error\npath that does idr_remove(\u0026ht-\u003ehandle_idr, handle) removes the\nreservation of a different, live knode, which is then reused — one\nfailed add compounds into further duplicates.\n\nThe 4095 limit is per (table, bucket) — ht-\u003ehandle_idr is per hash\ntable and the range is derived from htid (bucketid), so a table with\ndivisor 256 can legitimately hold 256*4095 knodes.\n\nThe sibling helper gen_new_htid() has the same silent in-band failure:\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and\nu32_init() publishes the root hash table with handle 0 without\nchecking.  Two root tables with handle 0 alias in u32_lookup_ht(),\nallowing cross-tcf_proto knode add/lookup/delete.  Add the same\nexhaustion check that the divisor path already has.\n\nReturn an error so u32_change() fails with ENOSPC/ENOMEM when the\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM\nwhen the hash table ID space is exhausted.  The extack message\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation\nfailure (-ENOMEM).\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded)\n- Create a clsact qdisc on a device, then add 4095 u32 filters with\n  auto-generated handles to fill the node ID space for the root hash\n  table (single bucket). The 4096th auto-handle filter add triggers\n  the duplicate handle (fh 800::fff reused). Reachable at Level 2\n  (unshare -Urn, namespace-local CAP_NET_ADMIN).\n- For gen_new_htid: create 2047 u32 proto entries on the same block\n  to fill the tp_c handle pool, then create one more. The root table\n  gets handle 0 and aliases with other handle-0 root tables.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted","id":"CVE-2026-98104","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"net: ethernet: oa_tc6: Improve the error recovery","id":"CVE-2026-98105"},"packages":[],"prev":{"headline":"igmp: convert struct ip_sf_list to RCU","id":"CVE-2026-98103"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A logic error in the Linux kernel's u32 classifier allows duplicate handles when node ID pools are exhausted, potentially causing data corruption or denial of service for local attackers with network administration capabilities.","url":"https://insights.sbomify.com/CVE-2026-98104/"}