CVE-2026-43238
Awaiting Analysis Awaiting Analysis - Queue
Divide-by-Zero in Linux Kernel net/sched act_skbedit

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is computed as: mapping_mod = queue_mapping_max - queue_mapping + 1; The range size can be 65536 when the requested range covers all possible u16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX). That value cannot be represented in a u16 and previously wrapped to 0, so tcf_skbedit_hash() could trigger a divide-by-zero: queue_mapping += skb_get_hash(skb) % params->mapping_mod; Compute mapping_mod in a wider type and reject ranges larger than U16_MAX to prevent params->mapping_mod from becoming 0 and avoid the crash.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
CVE-2026-43238
EUVD
EUVD-2026-27801
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel to U16_MAX (exc)
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's network scheduler component, specifically in the act_skbedit module. It involves a divide-by-zero error in the function tcf_skbedit_hash().

The issue arises because the calculation of a range size (mapping_mod) for queue mappings can overflow a 16-bit unsigned integer (u16). When the range covers all possible 16-bit queue IDs, the computed size wraps around to zero instead of representing 65536. This zero value is then used as a divisor, causing a divide-by-zero error and potentially crashing the kernel.

The fix involves computing the range size in a wider data type and rejecting ranges larger than the maximum 16-bit value to prevent the zero divisor and avoid the crash.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel to crash due to a divide-by-zero error in the network scheduler. Such a crash can lead to a denial of service (DoS) condition, disrupting network traffic handling and potentially affecting system stability and availability.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability in the Linux kernel related to a divide-by-zero error in tcf_skbedit_hash() has been fixed by computing the mapping_mod in a wider type and rejecting ranges larger than U16_MAX to prevent the crash.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue, specifically the commit identified as 38a6f0865796.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart