CVE-2026-31423 net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
A local attacker can cause a kernel divide-by-zero crash in the HFSC scheduler by triggering an integer truncation, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31423?
CVE-2026-31423 is a medium-severity vulnerability in Linux kernel, published on 13 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores the difference of two such u64 values in a u32 variable `dsm` and uses it as a divisor. When the difference is exactly 2^32 the truncation yields zero, causing a divide-by-zero oops in the concave-curve intersection path:
Oops: divide error: 0000 RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601) Call Trace: init_ed (net/sched/sch_hfsc.c:629) hfsc_enqueue (net/sched/sch_hfsc.c:1569) [...]
Widen `dsm` to u64 and replace do_div() with div64_u64() so the full difference is preserved.
Weakness: CWE-369
Which versions are affected by CVE-2026-31423?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31423?
Apply the vendor's patch.
Is CVE-2026-31423 being exploited?
There is no known exploitation of CVE-2026-31423 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-82694, BELL-CVE-2026-31423, DEBIAN-CVE-2026-31423, GHSA-mgjx-cg3q-7vjw, ROOT-OS-DEBIAN-11-CVE-2026-31423, ROOT-OS-DEBIAN-12-CVE-2026-31423 and 4 more.