DEBIAN-CVE-2026-99121: Divide by Zero
In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fibrebalance fibrebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass return zero while the second pass sees an eligible nexthop, resulting in division by zero. If the first pass reports a zero total, set each nexthop upper bound to -1 and skip the division. This matches the IPv6 fix in commit d2c26c2911dd ("ipv6: avoid divide by zero in rt6multipathrebalance") and preserves the lock-free rebalance path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In fib_rebalance(), when the first pass reports a zero total eligible nexthop weight, set each nexthop upper bound to -1 and skip the division.