CVE-2026-31423

Root

Cause

The vulnerability is a divide-by-zero bug present in the rtsc_min() function of the Linux kernel's Hierarchical Fair Service Curve (HFSC) packet scheduler (net/sched/sch_hfsc.c). The root cause stems from a type-width mismatch in the m2sm() helper, which converts a u32 slope value to a u64 scaled value. For large inputs (e.g., m1=4000000000), the result can reach 2^32. In rtsc_min(), the difference of two such u64 values is stored in a u32 variable dsm. When that difference is exactly 2^32, truncation yields zero, leading to a division-by-zero when used as a divisor in the concave-curve intersection computation [1].

Exploitation

Prerequisites

An attacker can trigger the divide-by-zero by creating a traffic class with carefully crafted HFSC service curve parameters (specifically a large m1 value). This requires the ability to configure traffic control (tc) rules on the system, which typically needs either root privileges or CAP_NET_ADMIN capability. No network access is required beyond local configuration ability [1].

Impact

Successful exploitation causes an immediate kernel oops (divide error) in the rtsc_min function, leading to a denial of service (DoS). The crash trace indicates the fault propagates through init_ed and hfsc_enqueue, effectively disabling the HFSC scheduler and potentially crashing the entire system [1].

Mitigation

Status The fix is available in the Linux kernel stable tree as commit d0aefec1b1a1 [1]. This patch widens dsm to u64 and replaces the do_div() macro with div64_u64(), preserving the full 64-bit difference and preventing the division by zero. System administrators should apply the corresponding kernel update for their distribution [1][2][3][4].