Junglewise Threat Intelligence

CVE-2026-23379: Linux Kernel divide by zero in net/sched ETS offload path

CVE-2026-23379 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs in the Enhanced Transmission Selection (ETS) scheduler, which manages how network traffic is prioritized. By triggering a specific calculation error, an attacker can cause a system-wide crash (kernel panic), leading to a complete service outage.

Technical details

A divide-by-zero error exists in the ets_offload_change function within net/sched/sch_ets.c. The vulnerability is caused by an integer overflow when calculating Weighted Round Robin (WRR) weights using 32-bit unsigned integers for 'q_sum' and 'q_psum'. When these values overflow, they can result in a zero value being used as a divisor. A local attacker with permissions to modify traffic control (tc) settings can exploit this to trigger a kernel panic. The fix involves upgrading the affected variables to 64-bit integers (u64) and using the div64_u64 helper function.

Affected products

  • Linux Linux Kernel 6.19.0-virtme
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-02-24: other: Patch authored
  • 2026-03-25: advisory: Initial NVD publication
  • 2026-03-25: patched: Committed to stable kernel tree
  • 2026-07-14: other: Siemens product impact added to advisory

References

Related threats