Skip to main content

Linux Kernel CVE-2026-43238

| EUVDEUVD-2026-27801 MEDIUM
Divide By Zero (CWE-369)
2026-05-06 Linux GHSA-76w3-fgp7-3hf7
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector and low privilege (CAP_NET_ADMIN) required to configure tc actions; outcome is kernel panic with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:55 vuln.today
CVSS changed
May 12, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()

Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is computed as:

mapping_mod = queue_mapping_max - queue_mapping + 1;

The range size can be 65536 when the requested range covers all possible u16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX). That value cannot be represented in a u16 and previously wrapped to 0, so tcf_skbedit_hash() could trigger a divide-by-zero:

queue_mapping += skb_get_hash(skb) % params->mapping_mod;

Compute mapping_mod in a wider type and reject ranges larger than U16_MAX to prevent params->mapping_mod from becoming 0 and avoid the crash.

AnalysisAI

Divide-by-zero in the Linux kernel's traffic control subsystem (net/sched/act_skbedit.c) crashes the kernel when a tc SKBEDIT action is configured with a queue mapping range spanning the full u16 address space. Affected kernels range from 5.19 (where commit 38a6f0865796 introduced SKBEDIT_F_TXQ_SKBHASH support) through all unpatched stable branches up to 7.0; vendor-released patches are available across six stable branches. No public exploit code exists and EPSS sits at 0.02% (7th percentile), making this a low-urgency patch cycle item for most environments, with highest relevance where low-privileged users can invoke tc configuration.

Technical ContextAI

The vulnerable code lives in the Linux kernel's tc (traffic control) action layer, specifically net/sched/act_skbedit.c. Commit 38a6f0865796 ('net: sched: support hash selecting tx queue') introduced SKBEDIT_F_TXQ_SKBHASH, which computes mapping_mod = queue_mapping_max - queue_mapping + 1 stored as a u16. When queue_mapping=0 and queue_mapping_max=U16_MAX (65535), the arithmetic yields 65536 - which overflows u16 and wraps to 0. The subsequent call skb_get_hash(skb) % params->mapping_mod in tcf_skbedit_hash() then performs an integer division by zero, triggering a kernel panic. CWE-369 (Divide By Zero) is the root cause class. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The fix widens the intermediate type for mapping_mod and rejects ranges exceeding U16_MAX before storing the value.

RemediationAI

Update to the appropriate patched Linux kernel stable release: 7.0, 6.19.6, 6.18.16, 6.12.75, 6.6.128, or 6.1.165. Upstream fix commits are available at git.kernel.org stable branches (e.g., https://git.kernel.org/stable/c/59809fda4da7730cfe84a948033f47eb45db073d for one branch; see all six commit references in the CVE for branch-specific links). Ubuntu users should apply the update referenced in USN-8492-1. Red Hat and SUSE users should monitor their respective security channels. As a compensating control prior to patching, restrict CAP_NET_ADMIN to trusted accounts and, on kernels that support it, disable unprivileged user namespace creation via sysctl -w kernel.unprivileged_userns_clone=0 - this prevents low-privileged users from obtaining CAP_NET_ADMIN within a namespace to invoke tc. Note that disabling unprivileged user namespaces may break container runtimes (e.g., Podman rootless, some Flatpak applications) and should be evaluated against workload requirements before deployment.

Same weakness CWE-369 – Divide By Zero

View all
CVE-2017-11720 CRITICAL POC
9.8
CVE-2012-0207 HIGH POC
7.5
CVE-2017-7598 HIGH POC
7.8
CVE-2016-3623 HIGH POC
7.5
CVE-2023-3896 HIGH POC
7.8
CVE-2023-1127 HIGH POC
7.8
CVE-2023-0512 HIGH POC
7.8
CVE-2021-29600 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43238 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy