CVE-2026-23379: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23379 is a divide-by-zero vulnerability in the Linux kernel's net/sched ETS (Enhanced Transmission Selection) qdisc offload path. It was disclosed on March 25, 2026, and affects a wide range of Linux kernel versions including 5.6 through various stable branches up to 6.19.x and 7.0 release candidates. The root cause is an integer overflow in 32-bit unsigned integer accumulators (q_sum and q_psum) used when computing WRR (Weighted Round Robin) weights during ETS offload, which can produce a zero denominator and trigger a fatal kernel divide error. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-369 (Divide By Zero). When the Linux kernel's ETS scheduler offloads configuration to hardware, it computes per-class WRR weights by summing DRR quanta into q_sum and q_psum variables typed as unsigned int. Because individual quanta can be large, the sum overflows the 32-bit integer, wrapping to zero and causing a division-by-zero fault in ets_offload_change(). The crash is triggered via a crafted tc (traffic control) netlink command that configures the ETS qdisc, as shown in the kernel oops trace: RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets] followed by Kernel panic - not syncing: Fatal exception. The fix replaces the 32-bit accumulators with 64-bit integers to prevent overflow (Red Hat Bugzilla, git.kernel.org).

Successful exploitation causes a fatal kernel panic and complete system crash, resulting in a denial of service (DoS) with full availability impact. There is no confidentiality or integrity impact — the vulnerability is purely a stability issue. A local attacker with low privileges can render the affected system entirely unavailable by sending specially crafted netlink traffic control commands, making this particularly relevant in multi-tenant or shared Linux environments (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to issue netlink tc commands, limiting the attack surface to users with shell access or the ability to run unprivileged network configuration commands (Red Hat CVE).

1. Gain local access: Obtain a low-privileged local shell on a system running an affected Linux kernel version (e.g., 5.6–5.10.252, 5.11–5.15.202, 5.16–6.1.166, 6.2–6.6.129, 6.7–6.12.76, 6.13–6.18.16, 6.19–6.19.6, or 7.0-rc1 through rc7).
2. Verify ETS module availability: Confirm the sch_ets kernel module is loaded or loadable (lsmod | grep sch_ets or attempt modprobe sch_ets).
3. Identify a network interface: Select a network interface that supports ETS qdisc offloading (typically a hardware NIC with TC offload support).
4. Craft malicious tc command: Use the tc utility to configure an ETS qdisc with quanta values large enough to cause the 32-bit q_sum/q_psum accumulators to overflow to zero. For example: tc qdisc add dev <iface> root handle 1: ets bands 8 quanta <large_values...>
5. Trigger divide-by-zero: The kernel's ets_offload_change() function attempts to divide by the overflowed (zero) sum, triggering a fatal divide error and kernel panic, crashing the system (Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing divide error: 0000 [#1] and RIP: 0010:ets_offload_change+0x11f/0x290 [sch_ets].
• Logs: Kernel panic messages: Kernel panic - not syncing: Fatal exception following an ETS qdisc configuration event.
• Process: Unusual or repeated invocations of the tc command by low-privileged users, particularly with ets qdisc and large quanta values.
• Network: Netlink socket activity (NETLINK_ROUTE) from non-root processes configuring qdiscs on hardware-offload-capable interfaces.
• System: Unexpected system reboots or crashes correlated with traffic control configuration changes.

Apply the upstream kernel patches that replace 32-bit unsigned int with 64-bit integers for q_sum and q_psum in the ETS offload path. Patched stable kernel versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7 (git.kernel.org). Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:1661-1), Amazon Linux 2023 (ALAS2023-2026-1543), Debian, and Microsoft (Azure Linux 3). As a workaround where patching is not immediately possible, restrict access to tc netlink commands via capabilities (e.g., remove CAP_NET_ADMIN from untrusted users) and avoid loading or using the sch_ets module if ETS offloading is not required (Red Hat CVE, Red Hat Bugzilla).