Junglewise Threat Intelligence

CVE-2026-31423: Linux Kernel divide-by-zero in HFSC network scheduler

CVE-2026-31423 · Severity: medium · CVSS 5.5 · Published 2026-04-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's network scheduling component could allow a local user to crash the system. The issue occurs in the Hierarchical Fair Service Curve (HFSC) scheduler, which manages network traffic priority. By providing specific large input values, an attacker can trigger a mathematical error that causes the operating system to stop functioning, leading to a denial-of-service condition.

Technical details

A divide-by-zero vulnerability exists in net/sched/sch_hfsc.c within the rtsc_min() function. The root cause is an integer truncation issue where the difference between two u64 scaled values is stored in a u32 variable 'dsm'. When the difference is exactly 2^32, the value truncates to zero and is subsequently used as a divisor in the concave-curve intersection path. A local attacker with the ability to configure or influence HFSC queueing disciplines can trigger this 'divide error' oops, resulting in a system crash. The fix involves widening 'dsm' to u64 and using div64_u64() to preserve the full precision of the divisor.

Affected products

  • Linux Linux Kernel versions from 2.6.12.1 up to 5.10.253, 5.11 up to 5.15.203, 5.16 up to 6.1.168, 6.2 up to 6.6.134, 6.7 up to 6.12.81, 6.13 up to 6.18.22, 6.19 up to 6.19.12, and 7.0-rc1 through 7.0-rc6

Timeline

  • 2026-03-26: disclosed: Vulnerability reported and patch authored by Xiang Mei.
  • 2026-04-11: patched: Patches committed to various stable kernel branches.
  • 2026-04-13: advisory: CVE-2026-31423 published.

References

Related threats