CVE-2026-23379: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23379 is a divide-by-zero vulnerability in the Linux kernel's net/sched ETS (Enhanced Transmission Selection) qdisc offload path. It was disclosed on March 25, 2026, and affects a wide range of Linux kernel versions including 5.6 through various stable branches up to 6.19.x and 7.0 release candidates. The root cause is an integer overflow in 32-bit unsigned integer accumulators (q_sum and q_psum) used when computing WRR (Weighted Round Robin) weights during ETS offload, which can produce a zero denominator and trigger a fatal kernel divide error. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-369 (Divide By Zero). When the Linux kernel's ETS scheduler offloads configuration to hardware, it computes per-class WRR weights by summing DRR quanta into q_sum and q_psum variables typed as unsigned int. Because individual quanta can be large, the sum overflows the 32-bit integer, wrapping to zero and causing a division-by-zero fault in ets_offload_change(). The crash is triggered via a crafted tc (traffic control) netlink command that configures the ETS qdisc, as shown in the kernel oops trace: RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets] followed by Kernel panic - not syncing: Fatal exception. The fix replaces the 32-bit accumulators with 64-bit integers to prevent overflow (Red Hat Bugzilla, git.kernel.org).

Successful exploitation causes a fatal kernel panic and complete system crash, resulting in a denial of service (DoS) with full availability impact. There is no confidentiality or integrity impact — the vulnerability is purely a stability issue. A local attacker with low privileges can render the affected system entirely unavailable by sending specially crafted netlink traffic control commands, making this particularly relevant in multi-tenant or shared Linux environments (Red Hat CVE, Red Hat Bugzilla).

1. Gain local access: Obtain a low-privileged local shell on a system running an affected Linux kernel version (e.g., 5.6–5.10.252, 5.11–5.15.202, 5.16–6.1.166, 6.2–6.6.129, 6.7–6.12.76, 6.13–6.18.16, 6.19–6.19.6, or 7.0-rc1 through rc7).
2. Verify ETS module availability: Confirm the sch_ets kernel module is loaded or loadable (lsmod | grep sch_ets or attempt modprobe sch_ets).
3. Identify a network interface: Select a network interface that supports ETS qdisc offloading (typically a hardware NIC with TC offload support).
4. Craft malicious tc command: Use the tc utility to configure an ETS qdisc with quanta values large enough to cause the 32-bit q_sum/q_psum accumulators to overflow to zero. For example: tc qdisc add dev <iface> root handle 1: ets bands 8 quanta <large_values...>
5. Trigger divide-by-zero: The kernel's ets_offload_change() function attempts to divide by the overflowed (zero) sum, triggering a fatal divide error and kernel panic, crashing the system (Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing divide error: 0000 [#1] and RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets].
• Logs: Kernel panic messages: Kernel panic - not syncing: Fatal exception following an ETS qdisc configuration event.
• Process: Unusual or repeated invocations of the tc command by low-privileged users, particularly with ets qdisc and large quanta values.
• Network: Netlink socket activity (NETLINK_ROUTE) from non-root processes configuring qdiscs on hardware-offload-capable interfaces.
• System: Unexpected system reboots or crashes correlated with traffic control configuration changes.

Apply the upstream kernel patches that replace 32-bit unsigned int with 64-bit integers for q_sum and q_psum in the ETS offload path. Patched stable kernel versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7 (git.kernel.org). Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:1661-1), Amazon Linux 2023 (ALAS2023-2026-1543), Debian, and Microsoft (Azure Linux 3). As a workaround where patching is not immediately possible, restrict access to tc netlink commands via capabilities (e.g., remove CAP_NET_ADMIN from untrusted users) and avoid loading or using the sch_ets module if ETS offloading is not required (Red Hat CVE, Red Hat Bugzilla).