CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-13 · updated 2026-10-15
Weakness: CWE-369

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable `dsm` and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path: Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...] Widen `dsm` to u64 and replace do_div() with div64_u64() so the full difference is preserved.

Affected products

Linux kernel: from 2.6.12.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22 — fixed in 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12

How to fix

Upgrade to a fixed version: Linux kernel 5.10.253, 5.15.203, 6.1.168, 6.12.81. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31423 or the next vulnerability affects your stack