CVE-2026-97598

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: bound automatic table ID allocation

fib_empty_table() probes every table ID from 1 until it finds a

free one. IPv4 tables are stored in a 256-bucket hash table, so a

dense set of IDs makes each probe walk a growing hash chain while

RTNL is held.

Automatic table assignment ("ip rule ... table 0") is an IPv4-only

legacy path. Bound the automatically allocated ID to 4096 so the

RTNL hold stays bounded, without changing lookups of explicitly

specified table IDs.

This changes user-visible behavior. A table-0 rule previously

received the lowest free ID in 1..RT_TABLE_MAX (0xFFFFFFFF). After

this patch the search stops at 4096 and the rule add fails with

ENOBUFS if that range is fully occupied. Explicit table IDs above

4096 remain usable.

The automatic path is unused in practice: it is IPv4-only, not

documented by ip-rule, uncovered by kernel selftests, and both

NetworkManager and systemd refuse table 0.