Executive brief
A vulnerability in the Linux kernel's network scheduling component could allow a local user to crash the system. The issue occurs when processing specific network traffic queue settings, leading to a system halt or 'kernel panic.' This impacts the availability of the server but does not directly expose sensitive data.
Technical details
A divide-by-zero vulnerability exists in net/sched/act_skbedit.c within the tcf_skbedit_hash() function. The root cause is an integer overflow when calculating the 'mapping_mod' value; when a user provides a range covering all possible u16 queue IDs (0 to 65535), the calculation (max - min + 1) results in 65536, which wraps to 0 in a u16 type. A local attacker with permissions to configure network traffic control (tc) can trigger this by setting an invalid queue mapping range, resulting in a kernel crash. The fix involves using a wider data type (u32) for the calculation and explicitly rejecting ranges larger than U16_MAX.
Affected products
- Linux Linux Kernel 5.19 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-02-14: patched: Initial patch authored by Ruitong Liu
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-12: advisory: NVD advisory published/updated
References
- https://git.kernel.org/stable/c/015cebdfcb97b5347fb7f598ea712a281cb35840
- https://git.kernel.org/stable/c/3c2b95b26860bd6f8e2310d31ea1200d3f8f173e
- https://git.kernel.org/stable/c/4ece5eb4836f8ff03b9004dc2430a7169f282851
- https://git.kernel.org/stable/c/59809fda4da7730cfe84a948033f47eb45db073d
- https://git.kernel.org/stable/c/9c735a7d98c982a786b0db71eb6566ee00aaa04f
- https://git.kernel.org/stable/c/be054cc66f739a9ba615dba9012a07fab8e7dd6f