A kernel bug in the net/sched cls_u32 module creates a manual hash table with an explicit handle that keys the IDR entry on the raw handle. When a table is deleted, the destroy path frees the entry under handle2id(handle) instead of the raw key, leaving an IDR entry unreachable and permanently leaked. The deletion can also remove the IDR entry of an unrelated live auto table, causing future auto allocations to hand out a handle that aliases the previously deleted manual table. This misrouting of packet lookups can lead to incorrect traffic control behavior or a denial of service. The underlying weakness involves improper resource release (memory leak) and resource exhaustion if the system cannot allocate new handles, corresponding to CWE‑400 and CWE‑401.

All Linux kernel installations that include the net/sched cls_u32 implementation and have not been updated to incorporate the patch commit are affected. The vulnerability exists in every kernel version before the upstream patch described in the pull request history of the Linux kernel repository. No specific distribution or version list is provided, so any distribution that ships a pre‑patched kernel is potentially impacted.

The exploit requires privileged access to the kernel, typically root or a user with the ability to add or delete traffic‑control filters. Although no public exploit is currently known, the absence of an EPSS score and the lack of entry in the CISA KEV catalog suggest that the probability of immediate exploitation is uncertain but not negligible. The combination of a permanent memory leak and the potential for misrouted traffic make the vulnerability a moderate to high risk, especially in environments with high network traffic volumes or where traffic‑control filters are heavily used.