Skip to main content

Linux Kernel CVE-2026-43267

| EUVDEUVD-2026-27664 MEDIUM
Divide By Zero (CWE-369)
2026-05-06 Linux GHSA-jgp7-74rh-r6jv
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to trigger driver code path; purely availability impact via kernel panic, no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:50 vuln.today
CVSS changed
May 08, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix potential zero beacon interval in beacon tracking

During fuzz testing, it was discovered that bss_conf->beacon_int might be zero, which could result in a division by zero error in subsequent calculations. Set a default value of 100 TU if the interval is zero to ensure stability.

AnalysisAI

Division by zero in the Linux kernel's rtw89 WiFi driver can crash the kernel when beacon interval is zero during beacon tracking. Discovered via fuzz testing, this local vulnerability (AV:L/PR:L) affects systems running any Linux kernel from initial commit through stable branches prior to 6.18.16, 6.19.6, and 7.0. An authenticated local attacker can trigger a kernel panic, resulting in a complete denial of service on the affected host. No public exploit exists and no active exploitation has been observed.

Technical ContextAI

The affected component is the rtw89 wireless driver (drivers/net/wireless/realtek/rtw89), which supports Realtek RTW89-series IEEE 802.11 WiFi chipsets commonly found in consumer and enterprise laptops. The root cause is CWE-369 (Divide By Zero): the driver's beacon tracking logic uses bss_conf->beacon_int (beacon interval, measured in Time Units) as a divisor without validating that it is non-zero. During fuzz testing, a zero value was observed on this field, causing a division by zero that results in a kernel panic. Per the CPE strings (cpe:2.3:a:linux:linux:*), the affected product spans a broad commit range from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through three separate stable-branch fix commits. The fix sets a default beacon interval of 100 TU when the field is zero, a standard 802.11 fallback value.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 6.18.16, 6.19.6, or 7.0 as applicable. Upstream fix commits are available at https://git.kernel.org/stable/c/1260bee01493126cf9c872b6ca2af261173baa6d, https://git.kernel.org/stable/c/e00c9a4ec84c0bb067833b34202f457badbbc1c1, and https://git.kernel.org/stable/c/eb57be32f438c57c88d6ce756101c1dfbcc03bba. Red Hat and SUSE users should monitor their respective security advisories for backported kernel updates. As a compensating control where patching is not immediately possible, unloading or blacklisting the rtw89 kernel module (modprobe -r rtw89 or adding 'blacklist rtw89' to /etc/modprobe.d/) eliminates the attack surface entirely, with the trade-off of disabling Realtek RTW89-series WiFi functionality on the affected host. This control is effective because the vulnerable code path is only reachable when the driver is active.

Same weakness CWE-369 – Divide By Zero

View all
CVE-2017-11720 CRITICAL POC
9.8
CVE-2012-0207 HIGH POC
7.5
CVE-2017-7598 HIGH POC
7.8
CVE-2016-3623 HIGH POC
7.5
CVE-2023-3896 HIGH POC
7.8
CVE-2023-1127 HIGH POC
7.8
CVE-2023-0512 HIGH POC
7.8
CVE-2021-29600 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43267 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy