CVE-2026-31423
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, the HFSC network scheduler (sch_hfsc) is vulnerable to a divide-by-zero in rtsc_min(). The issue occurs when the difference of two 64-bit scaled values exceeds 2^32 and is stored in a 32-bit variable, truncating it to zero and causing a division error.
Risk Assessment
An attacker can craft network traffic with specific parameters (e.g., m1=4000000000) to trigger a kernel oops, potentially causing a denial of service (DoS).
Recommendation
Immediately update the Linux kernel to a version containing the fix that widens the dsm variable to u64 and uses div64_u64().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable `dsm` and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path: Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...] Widen `dsm` to u64 and replace do_div() with div64_u64() so the full difference is preserved.