CVE-2026-97959

Executive Summary

CVE-2026-97959 is a resource exhaustion vulnerability in the Linux kernel's net/sched: cls_route component, where route4_change fails to free an emptied bucket when moving a filter to a different top-level bucket. This causes a memory leak that pins the tcf_proto structure, leading to resource exhaustion and potential denial of service. Affected systems are Linux hosts with CONFIG_NET_CLS_ROUTE4, CONFIG_NET_SCH_INGRESS, and CONFIG_NET_CLS_ACT enabled, and exploitation requires local access with CAP_NET_ADMIN.

Technical Analysis

The vulnerability resides in the cls_route traffic control classifier within the Linux kernel. The route4_change function handles filter modifications. When an existing filter is moved to a different top-level bucket—because route4_set_parms recomputes the handle from TCA_ROUTE4_TO, TCA_ROUTE4_FROM, and TCA_ROUTE4_IIF—the handle-mismatch check is gated on the 'new' flag. For existing filters, the new handle may differ from the old one, landing in a different bucket. The filter is unlinked from the old bucket, but the bucket itself is never freed once it becomes empty. This stale empty bucket remains in head->table[], causing route4_delete to report *last=false even after the last live filter is removed. Consequently, the empty tcf_proto is pinned, resulting in a memory leak. The fix introduces refcounting for filters linked to a bucket, freeing the bucket when the count reaches zero, and removes the existing scan in route4_delete.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a Linux system with the vulnerable kernel configuration and local access privileges, such as a container escape scenario or a multi-tenant environment where users have CAP_NET_ADMIN.
2. Triggering the flaw: The attacker uses tc commands to add an ingress filter and then change it to a different bucket, as shown in the recreation steps: tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1 followed by tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 route from 1 to 2. This causes the filter to move buckets, leaving an empty bucket unfreed.
3. Payload/execution method: No payload is executed; the attack simply manipulates traffic control structures. Repeatedly moving filters or creating new ones can accumulate stale buckets.
4. Post-exploitation impact: The memory leak consumes kernel memory, leading to resource exhaustion. Over time, this can degrade system performance, cause denial of service, or trigger a kernel panic. The pinned tcf_proto prevents proper cleanup, exacerbating the leak.

Impact Assessment

This vulnerability primarily impacts system availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Successful exploitation leads to memory exhaustion, potentially causing a denial of service. Affected systems include Linux servers, routers, and embedded devices with the specified kernel configuration. The blast radius is confined to the local system, but in multi-tenant environments, a malicious tenant could exhaust kernel memory, affecting other tenants. The EPSS score is not yet available, and no public exploit code exists, reducing immediate risk. However, the vulnerability is easy to trigger once local access is obtained.

Detection Guidance

Sigma Rule

title: Suspicious tc filter manipulation for cls_route
status: experimental
description: Detects tc commands manipulating route classifier filters to trigger CVE-2026-97959
author: Threat Intel
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/tc'
    CommandLine|contains|all:
      - 'filter'
      - 'route'
      - 'from'
      - 'to'
  condition: selection
falsepositives:
  - Legitimate network configuration
level: medium

YARA Rule

rule CVE_2026_97959_ClsRoute
{
    meta:
        description = "Detects kernel memory leak due to cls_route bucket issue"
        author = "Threat Intel"
        date = "2026-01-01"
        reference = "CVE-2026-97959"
    strings:
        $s1 = "route4_change" ascii wide
        $s2 = "route4_set_parms" ascii wide
        $s3 = "route4_delete" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-97959 Potential cls_route memory leak attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Note: Network detection is limited due to local nature; rule is generic.

Elastic Detection

process where process.name == "tc" and process.args : ("filter", "route", "change")

Splunk SPL Query

index=linux sourcetype=syslog "tc filter" "route" "change" | stats count by host, user

Wazuh OSSEC Rule

<group name="linux,cls_route,">
  <rule id="100001" level="8">
    <decoded_as>syslog</decoded_as>
    <match>tc filter.*route.*change</match>
    <description>CVE-2026-97959: Potential cls_route filter manipulation detected</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict local access to CAP_NET_ADMIN to trusted users. Disable the cls_route classifier if not required by removing CONFIG_NET_CLS_ROUTE4 from the kernel configuration. Monitor for anomalous tc commands.
2. Patch/upgrade steps: No official patch is available from tracked sources. Apply the upstream fix commit once released. Until then, consider backporting the refcounting fix manually if feasible.
3. Long-term hardening: Regularly update the kernel. Use least privilege principles for network administration. Implement kernel memory monitoring to detect leaks.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97959
• Linux kernel git repository (fix commit pending)
• CWE-772: https://cwe.mitre.org/data/definitions/772.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.