CVE-2026-37232: Divide by Zero
An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fillRRUPrbTotDl() and fillRRUPrbTotUl() in openair2/E2AP/RANFUNCTION/O-RAN/ranfunckpmsubs.c (lines 182 and 197) compute PRB usage percentages by dividing by the difference of two consecutive totalprbaggregate samples without checking for zero. When a malicious xApp sends a high volume of E42RICSUBSCRIPTIONREQUESTs via the FlexRIC iApp (port 36422/SCTP), the E2 Agent generates KPM Indication reports at high frequency. If two consecutive sampling intervals yield identical PRB aggregate values, the divisor becomes zero, triggering SIGFPE and crashing the entire 5G base station process (nr-softmodem). This results in complete 5G cell service interruption for all connected UEs. No authentication is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or unregister the E2SM-KPM RAN Function (PRB utilization / KPM reporting) when PRB reporting is not required to prevent generation of KPM Indication reports that can trigger the crash.
OpenAirInterface5G (E2 Agent / E2SM-KPM RAN Function) E2SM-KPM (PRB utilization reporting) = disabled (if not required) - Compensating control
Restrict network access to the FlexRIC iApp SCTP port 36422 to trusted management/control hosts only using firewall rules or ACLs; block or drop SCTP connections to port 36422 from untrusted networks.
- Compensating control
Implement rate-limiting and connection limits for E42_RIC_SUBSCRIPTION_REQUESTs/SCTP connections from xApps (per-source and global throttles) to prevent high-volume subscription floods that cause high-frequency KPM Indication generation.
- Operational
Deploy process supervision and monitoring for the nr-softmodem process (detect SIGFPE/crash), configure automatic restart and alerting, and ensure out-of-band recovery procedures and runbooks to restore 5G service quickly if nr-softmodem crashes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37232?
CVE-2026-37232 has a high severity rating of 8.6.
What vulnerability does CVE-2026-37232 address?
CVE-2026-37232 addresses a divide by zero vulnerability in the PRB utilization metric calculation of OpenAirInterface5G.
How do I fix CVE-2026-37232?
To fix CVE-2026-37232, update to the latest version of OpenAirInterface5G that resolves this issue.
What software is affected by CVE-2026-37232?
CVE-2026-37232 affects the OpenAirInterface5G nr-softmodem version 2.4.0.
When was CVE-2026-37232 published?
CVE-2026-37232 was published on June 1, 2026.