The kernel’s U32 traffic‑control filter module incorrectly handles the allocation of node identifiers when its pool is exhausted. Instead of reporting an error, the allocator silently returns the maximum allowable handle that is already in use, causing the filter creation routine to insert a duplicate entry in the hash table. This breaks the uniqueness guarantee of knode handles, leading to unpredictable behaviour of the classification subsystem.

All Linux kernel versions that enable CONFIG_NET_SCHED and CONFIG_CLS_U32 are affected. Most mainstream distributions compile these options in by default. Any kernel release prior to the commit that added explicit ENOSPC/ENOMEM error handling for exhaustion is vulnerable. The issue is confined to the kernel’s traffic‑control subsystem; user‑space components are not directly touched.

Exploitation requires local privileged access with the CAP_NET_ADMIN capability to add U32 filters. An attacker can create a large number of auto‑generated filters to exhaust the node ID space, trigger duplicate handle insertion, and potentially cause the kernel to crash or the traffic‑control table to become inconsistent, resulting in a denial‑of‑service of packet classification. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Without privileged access or a large number of filters, the risk is low.