A kernel bug in the net/sched cls_u32 module creates a manual hash table with an explicit handle that keys the IDR entry on the raw handle. When a table is deleted, the destroy path frees the entry under handle2id(handle) instead of the raw key, leaving an IDR entry unreachable and permanently leaked. The deletion can also remove the IDR entry of an unrelated live auto table, causing future auto allocations to hand out a handle that aliases the previously deleted manual table. This misrouting of packet lookups can lead to incorrect traffic control behavior or a denial of service. The underlying weakness involves improper resource release, reflected by CWE‑694.

All Linux kernel installations that include the net/sched cls_u32 implementation and have not been updated to incorporate the patch commit are affected. The vulnerability exists in every kernel version before the upstream patch described in the pull request history of the Linux kernel repository. No specific distribution or version list is provided, so any distribution that ships a pre‑patched kernel is potentially impacted.

The likely attack vector requires privileged access to the kernel, such as root or a user with the ability to add or delete traffic‑control filters; this inference is drawn from the need to manipulate traffic‑control filters. The CVSS score is 3.3, indicating a low severity impact, and the EPSS score is below 1%, implying a low likelihood of exploitation. As a result, the overall risk is considered low, although the presence of a permanent memory leak and potential misrouted traffic still warrant attention in environments that heavily use traffic‑control filters.