SB20260928248 - Memory leak in Linux kernel sched

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-97959)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to a failure to free an emptied route4 bucket in net/sched/cls_route.c route4_change when moving an existing route filter to a different top-level bucket and deleting it. A local user can move an existing route filter to a different top-level bucket and then delete it to cause a memory leak.

The issue requires CONFIG_NET_CLS_ROUTE4, CONFIG_NET_SCH_INGRESS, and CONFIG_NET_CLS_ACT to be enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1853f30cf5c84971f99788a76207c6f745380896
• https://git.kernel.org/stable/c/2e2f130951d34871b0643bf700164d97cff4b427
• https://git.kernel.org/stable/c/81dd117c04422c6d0c7974aba9fa6a0ba370959b
• https://git.kernel.org/stable/c/f8495d67434e1cb7e511297687ca55fdb28e4c20