CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls u32: fix duplicate handle when node ID pool is exhausted

gen new kid() falls back to returning max (htid | 0xFFF) when both idr alloc u32() ranges are full, instead of reporting an error. u32 change() trusts that value and inserts a new knode with a handle that is already live in the hash table, breaking handle uniqueness within the table's node ID space.

The handle was never reserved in ht->handle idr, so every later error path that does idr remove(&ht->handle idr, handle) removes the reservation of a different, live knode, which is then reused — one failed add compounds into further duplicates.

The 4095 limit is per (table, bucket) — ht->handle idr is per hash table and the range is derived from htid (bucketid), so a table with divisor 256 can legitimately hold 256*4095 knodes.

The sibling helper gen new htid() has the same silent in-band failure: it returns 0 when the tp c handle pool (1..0x7FF) is full, and u32 init() publishes the root hash table with handle 0 without checking. Two root tables with handle 0 alias in u32 lookup ht(), allowing cross-tcf proto knode add/lookup/delete. Add the same exhaustion check that the divisor path already has.

Return an error so u32 change() fails with ENOSPC/ENOMEM when the node ID space is exhausted, and so u32 init() fails with -ENOMEM when the hash table ID space is exhausted. The extack message distinguishes pool exhaustion (-ENOSPC) from a transient allocation failure (-ENOMEM).

Conditions to recreate the bug: