CVE-2026-31423
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable `dsm` and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path: Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...] Widen `dsm` to u64 and replace do_div() with div64_u64() so the full difference is preserved.
How to fix
- linux linux_kernel5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12 or later
- git.kernel.org/stable/c/17c1b9807b8a67d676b6dcf749ee932ebaa7f568
- git.kernel.org/stable/c/25b6821884713a31e2b49fb67b0ebd765b33e0a9
- git.kernel.org/stable/c/4576100b8cd03118267513cafacde164b498b322
- git.kernel.org/stable/c/ab1ff5890c7354afc7be56502fcfbd61f3b7ae4f
- git.kernel.org/stable/c/ad8e8fec40290a8c8cf145c0deaadf76f80c5163
- git.kernel.org/stable/c/b9e6431cbea8bb1fae8069ed099b4ee100499835
- git.kernel.org/stable/c/c56f78614e7781aaceca9bd3cb2128bf7d45c3bd
- git.kernel.org/stable/c/d0aefec1b1a1ba2c1d251028dc2c4e5b4ce1fea5
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.12.1 ≤ v < 5.10.253, 5.11 ≤ v < 5.15.203, 5.16 ≤ v < 6.1.168, 6.2 ≤ v < 6.6.134, 6.7 ≤ v < 6.12.81, 6.13 ≤ v < 6.18.22, 6.19 ≤ v < 6.19.12, 2.6.12, 7.0 | 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.