Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs in the Enhanced Transmission Selection (ETS) scheduler, which manages how network traffic is prioritized. By triggering a specific calculation error, an attacker can cause a system-wide crash (kernel panic), leading to a complete service outage.
Technical details
A divide-by-zero error exists in the ets_offload_change function within net/sched/sch_ets.c. The vulnerability is caused by an integer overflow when calculating Weighted Round Robin (WRR) weights using 32-bit unsigned integers for 'q_sum' and 'q_psum'. When these values overflow, they can result in a zero value being used as a divisor. A local attacker with permissions to modify traffic control (tc) settings can exploit this to trigger a kernel panic. The fix involves upgrading the affected variables to 64-bit integers (u64) and using the div64_u64 helper function.
Affected products
- Linux Linux Kernel 6.19.0-virtme
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-02-24: other: Patch authored
- 2026-03-25: advisory: Initial NVD publication
- 2026-03-25: patched: Committed to stable kernel tree
- 2026-07-14: other: Siemens product impact added to advisory
References
- https://git.kernel.org/stable/c/3912871344d6a0f1f572a7af2716968182d1e536
- https://git.kernel.org/stable/c/62015c05878eb9ca448dca7f5a74423d10d40789
- https://git.kernel.org/stable/c/78b8d2f55a564236435649fbd8bd6a103f30acf5
- https://git.kernel.org/stable/c/7dbffffd5761687e168fb2f4aaa7a2c47e067efc
- https://git.kernel.org/stable/c/a11ec75a029b3a22b5596f98ce91a3be76a86213
- https://git.kernel.org/stable/c/a6677e23b313cd9fd03690c589c6452cb6fffb97
- https://git.kernel.org/stable/c/abe1d5cb7fe135c0862c58db32bc29e04cf1c906