The vulnerability originates in the Linux kernel’s CLS_u32 traffic‑control module, which mishandles node identifier allocation when its pool is exhausted. Instead of signaling an error, the allocator returns the maximum allowable handle that is already in use, leading the filter‑creation routine to insert a duplicate entry into the hash table. This breaks the uniqueness guarantee of knode handles and can cause inconsistent packet classification or kernel instability.

All Linux kernels that enable CONFIG_NET_SCHED and CONFIG_CLS_U32, regardless of whether these options are compiled as built‑in or as modules. The issue is present in any kernel configuration that permits user‑space creation of u32 filters on network interfaces.

To exploit the flaw, an attacker must possess CAP_NET_ADMIN on the target system. By creating many auto‑generated u32 filters—e.g., 4095 entries on a single hash table—an adversary can exhaust the node ID space, trigger the duplicate handle behavior, and potentially cause a denial of service. The CVSS score of 5.5 reflects moderate severity; an EPSS score of <1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog.