CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
In the Linux kernel, the following vulnerability has been resolved:
net/sched: actskbedit: fix divide-by-zero in tcfskbedithash()
Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDITFTXQSKBHASH support. The inclusive range size is computed as:
mappingmod = queuemappingmax - queuemapping + 1;
The range size can be 65536 when the requested range covers all possible u16 queue IDs (e.g. queuemapping=0 and queuemappingmax=U16MAX). That value cannot be represented in a u16 and previously wrapped to 0, so tcfskbedithash() could trigger a divide-by-zero:
queuemapping += skbgethash(skb) % params->mappingmod;
Compute mappingmod in a wider type and reject ranges larger than U16MAX to prevent params->mappingmod from becoming 0 and avoid the crash.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43238?
CVE-2026-43238 has a high severity due to its potential to cause a divide-by-zero error in the Linux kernel.
How do I fix CVE-2026-43238?
To fix CVE-2026-43238, update your Linux kernel to the latest version that includes the patch for the divide-by-zero vulnerability.
What systems are affected by CVE-2026-43238?
CVE-2026-43238 affects various versions of the Linux kernel, particularly those using the net/sched and act_skbedit functionalities.
What is the impact of CVE-2026-43238?
The impact of CVE-2026-43238 can lead to system instability and potentially allow attackers to exploit the divide-by-zero vulnerability.
Have there been any exploits for CVE-2026-43238?
As of now, there are no publicly known exploits for CVE-2026-43238, but it is advisable to apply patches to mitigate any risks.