In Linux kernel IPv4 routing, automatic allocation of routing table IDs was uncontrolled, causing the kernel to probe sequentially for a free ID while holding the RTNL lock. This could grow the hash chains and lengthen the lock duration, leading to high CPU usage or a stall of the kernel’s networking stack. The vulnerability also limited table assignment to 4096 and returned an ENOBUFS error if that range was exhausted, potentially denying legitimate rule creation. It is a classic resource exhaustion scenario that can compromise availability.

All Linux kernel builds before the recent patch apply to any vendor that compiles the kernel unchanged. The vulnerable code path is specific to IPv4, is a legacy feature, and is not used by most modern network managers or systemd, which typically avoid table 0. However, any distribution that still supports automatic table ID allocation without the new 4096 cap can be affected.

The entry is not listed in CISA KEV and the EPSS score is < 1%, indicating low external exploitation data; the CVSS score is 5.5. The weakness is local; an attacker would need the ability to insert an IPv4 rule with table ID 0 or otherwise exercise the auto‑allocation path to trigger the DoS. Because the feature is undocumented and rarely used, and the kernel holds a lock during enumeration, practitioners can consider the likelihood of opportunistic exploitation low, though a determined local attacker could still trigger denial of service by exhausting the 4096 range. The patch is already released, so the main risk is unpatched systems.