Junglewise Threat Intelligence

CVE-2026-43238: Linux Kernel divide-by-zero in act_skbedit network scheduler

CVE-2026-43238 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's network scheduling component could allow a local user to crash the system. The issue occurs when processing specific network traffic queue settings, leading to a system halt or 'kernel panic.' This impacts the availability of the server but does not directly expose sensitive data.

Technical details

A divide-by-zero vulnerability exists in net/sched/act_skbedit.c within the tcf_skbedit_hash() function. The root cause is an integer overflow when calculating the 'mapping_mod' value; when a user provides a range covering all possible u16 queue IDs (0 to 65535), the calculation (max - min + 1) results in 65536, which wraps to 0 in a u16 type. A local attacker with permissions to configure network traffic control (tc) can trigger this by setting an invalid queue mapping range, resulting in a kernel crash. The fix involves using a wider data type (u32) for the calculation and explicitly rejecting ranges larger than U16_MAX.

Affected products

  • Linux Linux Kernel 5.19 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-02-14: patched: Initial patch authored by Ruitong Liu
  • 2026-05-06: disclosed: CVE published by kernel.org
  • 2026-05-12: advisory: NVD advisory published/updated

References

Related threats